Network realtime monitoring and control system

ABSTRACT

A network real-time monitoring and control system includes several layers of components for generating a network traffic shaping control that is used to shaping network traffic flows for one or more network nodes. The layers of the network real-time monitoring and control system include a monitoring layer, an event control layer, a traffic shaping control layer, a reporting layer, and an administrative layer. The monitoring obtains network traffic indicator measurements and network node operational indicator measurements. The event control layer uses the indicator measurements to generate a network event identifier, and generates a request for a network traffic shaping control based on a correlation of the network event identifier with a network node status identifier. The request for the network traffic shaping control is communicated to the traffic shaping control layer to generate a network traffic shaping control.

PRIORITY CLAIM

This application claims the benefit of EPO Patent Application No. ______filed ______, which is incorporated herein by reference in its entirety.

CROSS-REFERENCE TO RELATED APPLICATIONS

Co-pending and commonly assigned U.S. patent application Ser. No. ______titled “Control Management of Voice-Over-IP Parameters,” and assignedAttorney Docket No. 10022/1380, has been filed on the same date as thepresent application, and is incorporated herein by reference in itsentirety.

BACKGROUND

1. Technical Field

This application relates to a network real-time monitoring and controlsystem and, in particular, a network real-time monitoring and controlsystem that outputs a network traffic shaping control based oncorrelating a network event identifier with a network node statusidentifier.

2. Related Art

A Public Switch Telephone Network (“PSTN”) typically provides the systemarchitecture for implementing telecommunication services. However,implementing telecommunication services over a PSTN can sometimes beexpensive and time-consuming. Moreover, the equipment in which aprovider must invest in to provide telecommunication services on a PSTNcan be expensive, as well as the costs for leasing access to the PSTN.Hence, an entity that desires to enter the telecommunicationsmarketplace would prefer an alternative to using a PSTN for providingtelecommunication services.

Since the advent of the Internet, more and more entities are turning tothe use of a packet-switched Next Generation Network (“NGN”). Ingeneral, NGN focuses on the concept of one network transporting allinformation and services (voice, data, and all sorts of media such asvideo) by encapsulating these into packets, like it is on the Internet.In addition, an NGN may provide telecommunication services and be ableto make use of multiple broadband, Quality of Service-enabled transporttechnologies. Furthermore, the service-related functions of an NGN maybe independent from underlying transport-related technologies. An NGNmay also offer unrestricted access by users to different serviceproviders.

One of the telecommunication services provided by a telecommunicationservice provider using an NGN may be Voice-Over-Internet-Protocol(“VoIP”) service. In general, a VoIP service employs session controlprotocols to control the set-up and tear-down of calls over apacket-switched network, such as an NGN. A VoIP service may also provideaudio encoding algorithms that digitally encode speech for transmissionover the packet-switched network.

As VoIP is a desirable competitor to traditional telecommunicationservices, a telecommunication service provider may desire to enter thetelecommunications marketplace by providing VoIP service over an NGN.However, a telecommunication service provider seeking to implement VoIPservices over an NGN faces unique challenges. Examples of thesechallenges include providing quality service during peak usage times andproviding service when the number of concurrent VoIP calls meets orexceeds the number of concurrent attempted calls served by thetelecommunication service provider.

SUMMARY

This application provides for a network real-time monitoring and controlsystem that monitors and the controls the service of VoIP calls throughtraffic shaping. In one implementation, the network real-time monitoringand control system includes a real-time network monitor, an eventmanager, a real-time status analyzer, and a control manager. Thereal-time network monitor monitors the traffic flow of a network node incommunication with the network real-time monitoring and control system.In addition, the real-time network monitor may monitor specificindicators of traffic flow, such as signaling indicators, mediatreatment indicators, provisioning indicators, and others. The real-timenetwork monitor may also monitor the performance of the network node incommunication with the real-time monitoring and control system. Thereal-time network monitor may store one or more measurements indicativeof the traffic flow or performance of the network node.

The event manager generates events that may be defined according tochanges in traffic flows, changes in the performance of the networknode, or both. For example, an event may be defined by whether a networknode is accessible, or whether there is an increase in a traffic flow orin a network traffic indicator. In one implementation, the event managercompares the measurements taken by the real-time network monitor andcompares the measurements with a previously stored threshold. An eventmay be defined by whether the comparison of the measurements with thepreviously stored threshold indicates that the measurements exceed orfall below the previously stored threshold. The event manager may alsocalculate performance measurements based on the measurements from thereal-time network monitor, and compare the performance measurements withpreviously stored thresholds to determine whether an event should begenerated.

The real-time status analyzer correlates events generated by the eventmanager to determine the network status of the network node, the trafficflows, and the general network health of the telecommunication serviceprovider. In one implementation, the real-time status analyzercorrelates the generated events with network node status identifiersdefined by a network node status rule set. Each of the network nodestatus identifiers may be associated with a network node statuscondition that identifies the network node status identifier when thenetwork node status condition is satisfied. The network node status ruleset may also associate network node status condition priorities with thenetwork node status conditions. A network node status condition prioritymay indicate a priority level of a network node status condition suchthat a first network node status condition has a higher priority levelthan a second network node status condition. It is also possible thatone or more network node status conditions have the same priority level.

Once the real-time status analyzer has correlated a generated event witha network node status, the real-time status analyzer generates a requestfor a network traffic shaping control. In general, a network trafficshaping control defines the behavior for a network traffic shapingappliance. In one implementation, the request is output as a suggestionto a user, who may then accept the request for the network trafficshaping control or may reject the request for the network trafficshaping control. In an alternative implementation, the request for thenetwork traffic shaping control may be output to an automatic systemthat implements the network traffic shaping control, such as the controlmanager, which is described in more detail below.

The control manager is operative to implement the network trafficshaping control requested by the real-time status analyzer. In oneimplementation, the control manager automatically outputs the networktraffic shaping control. In an alternative implementation, the controlmanager outputs the network traffic shaping control when the real-timestatus analyzer receives an acceptance of the network traffic shapingcontrol. In implementing the network traffic shaping control, thecontrol manager may calculate a network traffic shaping controlintensity that specifies a network traffic intensity for the trafficflow or network node that triggered the request for the network trafficshaping control. The control manager may also specify additionalparameters for the network traffic shaping control. Once implemented,the control manager outputs the network traffic shaping control toanother system or device, such as a network traffic shaping appliance.While the network traffic shaping control is controlling the trafficflow or network node, the control manager handles the duration andtermination of the network traffic shaping control.

Other systems, methods, features and advantages will be, or will become,apparent to one with skill in the art upon examination of the followingfigures and detailed description. All such additional systems, methods,features and advantages are included within this description, are withinthe scope of the invention, and are protected by the following claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The system may be better understood with reference to the followingdrawings and description. The elements in the figures are notnecessarily to scale, emphasis instead being placed upon illustratingthe principles of the system. In the figures, like-referenced numeralsdesignate corresponding parts throughout the different views.

FIG. 1 shows one example of a network real-time monitoring and controlsystem.

FIG. 2 shows one example of the monitoring layer of the networkreal-time monitoring and control system shown in FIG. 1.

FIG. 3 shows one example of the event control layer of the networkreal-time monitoring and control system shown in FIG. 1.

FIG. 4 shows one example of a network node status rule set forcorrelating events with the status of a network node.

FIG. 5 shows one example of a service model used by the event controllayer shown in FIG. 3.

FIG. 6 shows one example of the traffic shaping control layer of thenetwork real-time monitoring and control system shown in FIG. 1.

FIG. 7 shows one example of the reporting layer and the administrativelayer of the network real-time monitoring and control system shown inFIG. 1.

FIG. 8 shows one example of a network traffic shaping control statemodel.

FIG. 9 shows one example of a pending state set and a running state setfor the network traffic shaping control state model in FIG. 8.

FIG. 10 shows one example of a finished state set for the networktraffic shaping control state model in FIG. 8.

FIG. 11 shows one example of a stopped state set for the network trafficshaping control state model in FIG. 8.

FIG. 12 shows one example of a terminated state set for the networktraffic shaping control model in FIG. 8.

FIG. 13 shows one example of logic flow for generating a network trafficshaping control for a network traffic shaping appliance.

FIG. 14 shows one example of logic flow for generating a network trafficshaping control where the generated network traffic shaping control issubject to acceptance.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1 shows one example of a network real-time monitoring and controlsystem 102 for monitoring and controlling network traffic flow input andoutput by one or more network nodes. The network real-time monitoringand control system 102 includes several layers for monitoring andcontrolling the input and output network traffic flow. In oneimplementation, the network real-time monitoring and control system 102includes a monitoring layer 104, an event control layer 106, a trafficshaping control layer 108, a reporting layer 110, and an administrativelayer 112.

The network real-time monitoring and control system 102 is incommunication with one or more network nodes 114-116. In general, anetwork node is an electronic device capable of sending, receiving, orforwarding information over a communications channel. The network nodes114-116 may be any type of network node. For example, one or more of thenetwork nodes 114-116 may be data circuit-terminating equipment (DCE)such as a modem, hub, bridge or switch. Alternatively, the network nodes114-116 may be data terminal equipment (DTE), such as a digitaltelephone handset, a printer or a computer. Other examples of networknodes 114-116 include a router, a workstation or a server. Additionalexamples of network nodes 114-116 include a public or private telephoneexchange, a remote concentrator or a computer providing network service.In one implementation, the network nodes 114-116 are Session InitiationProtocol (“SIP”) Servers, Home Subscriber Servers, SIP ApplicationServers, carrier-class session border controllers, such as the AcmePacket Net-Net 4250 or Acme Packet Net-Net 4500, available from AcmePacket located in Burlington, Mass., United States.

The network nodes 114-116 receive input network traffic flows 118 andtransmit output network traffic flows 120. The input network trafficflows 118 and output network traffic flows 120 may include differenttypes of network traffic. In one example the input network traffic flows118 may include signaling network traffic. An example of signalingnetwork traffic includes network traffic from SIP network traffic, suchas SIP REQUEST messages, SIP REGISTER messages, and other SIP messages.Another example of signaling network traffic is Real-Time StreamingProtocol (“RTSP”) network traffic. Signaling network traffic may alsoinclude network traffic from umbrella system specifications, such as theH.323 system specification that describes the use of severalTelecommunication Standardization Sector (“ITU-T”) and InternetEngineering Task Force (“IETF”) protocols. Other types of signalingnetwork traffic are also contemplated.

The input network traffic flows 118 may further include media treatmentnetwork traffic. An example of media treatment network traffic includesthe Real-Time Transport Protocol (“RTP”) network traffic. However, mediatreatment network traffic may also include other protocol networktraffic that manages the real-time transmission of multimedia data overunicast or multicast network services, a fax relay standard, such asT.38, or other protocol network traffic.

Furthermore, the input network traffic flows 118 may includeprovisioning network traffic. In general, provisioning network trafficrefers to network traffic that includes messages directed to the requestfor the provisioning of a telecommunication. However, provisioningnetwork traffic may also include network traffic that is related to thefirst activation of a service for a given user. Other types ofprovisioning network traffic are also contemplated.

The output network traffic flows 120 may include network traffic outputby one or more of the network nodes 114-116. For example, the outputnetwork traffic flows 120 may include responses to the messages of theinput network traffic flows 118. In one implementation, the outputnetwork traffic flows 120 include responses to SIP network traffic.Responses to SIP network traffic include informational responses, suchas TRYING responses, RINGING responses, and other informationalresponses; successful responses, such as OK responses, ACCEPTEDresponses, and other successful responses; redirection responses, suchas MULTIPLE CHOICES responses, MOVED PERMANENTLY responses, and otherredirection responses; and, other types of SIP network trafficresponses. The output network traffic flows 120 may also includeresponses to media treatment network traffic, provisioning networktraffic, and other types of network traffic.

The input network traffic flows 118 and output network traffic flows 120may also include network traffic in addition to signaling, mediatreatment, and provisioning network traffic flows. For example, theinput network traffic flows 118 may include Address Resolution Protocol(“ARP”) network traffic, Domain Name System (“DNS”) Protocol networktraffic, Transmission Control Protocol (“TCP”) network traffic, HyperText Transfer Protocol (“HTTP”) network traffic, and other types ofnetwork traffic. Similarly, the output network traffic flows 120 mayinclude responses to the aforementioned network traffic.

The monitoring layer 104 monitors the input network traffic flows 118and output network traffic flows 120 of the network nodes 114-116. Bymonitoring the input network traffic flows 118, the network real-timemonitoring and control system 102 can identify when one or more of thenetwork nodes 114-116 begins to destabilize or reach an instabilitystatus. For example, during an increase in SIP input network traffic,the network nodes 114-116 may be unable to satisfy all the SIP inputnetwork traffic flows 118. In these situations, the network nodes114-116 may destabilize, and the quality of service provided to the SIPinput network traffic may suffer.

Similar to preventing the destabilization of the network nodes 114-116through the monitoring of input network traffic flows 118, the real-timemonitoring and control system 102 may also prevent the destabilizationof the network nodes 114-116 through the monitoring of the outputnetwork traffic flows 120. By monitoring the output network trafficflows 120, the network real-time monitoring and control system 102 canidentify when one or more of the network nodes 114-116 begins todestabilize or reach an instability status. For example, during anincrease in SIP output network traffic, an increase in response outputnetwork traffic, or an increase in output network traffic, the networknodes 114-116 may be unable to maintain the level of output required tosatisfy all of the output network traffic flows 120. In thesesituations, the network nodes 114-116 may destabilize, and the qualityof service transmitted by the network nodes 114-116 may suffer.Furthermore, because the amount of outgoing network traffic maycorrelate to the amount of incoming network traffic, there is a highprobability that the incoming network traffic has caused the increase inoutgoing network traffic. Hence, by monitoring the output networktraffic flows 120, the network real-time monitoring and control system102 can control the amount of incoming input network traffic and preventthe destabilization of the network nodes 114-116.

In monitoring the input network traffic flows 118 and output networktraffic flows 120, the monitoring layer 104 may establish one or morenetwork traffic flow identifiers that identify the network traffic flows118-120. The network traffic flow identifiers may be stored in themonitoring layer 104 or in another layer of the network real-timemonitoring and control system 102, such as the event control layer 106.

The real-time network and control system 102 may communicate with one ormore probes 122 via the monitoring layer 104 to monitor the input andoutput network traffic flows 118-120. In general, a network trafficprobe 122 is a network appliance that analyzes the network traffic flowsto obtain a network traffic indicator measurement that provides ameasurement of a network traffic indicator for a network node. Asdiscussed with reference to FIG. 2, a network traffic indicator mayrepresent a particular network traffic type received or transmitted by anetwork node. The network traffic probe 122 may obtain the networktraffic indicator measurement, and then expose the network trafficindicator measurement to the network real-time monitoring and controlsystem 102 via a communication protocol, such as the Simple NetworkManagement Protocol (“SNMP”).

In one implementation, the network traffic probe 122 is includes one ormore components. For example, the network traffic probe 122 may includea packet analyzer and a statistic generator. Other components are alsopossible. In general, a packet analyzer is computer software or hardwarethat intercepts and logs network traffic passing over a network or partof a network. One example of a software packet analyzer is Wireshark,which is available from the Wireshark Foundation located in Davis,Calif., United States. The statistic generator is computer software orhardware that generates statistics associated with the network packetsanalyzed by the packet analyzer. Examples of statistics generated by thestatistic generator may include the number of packets analyzed, thenumber of packets analyzed for a particular network traffic type, orother statistic. The statistic generator may also be configured tomonitor network traffic indicators and obtain monitored network trafficindicator measurements from the monitored network traffic indicators.Other statistic operations by the statistic generator may also bepossible.

The exposure of the network traffic indicator measurement may occurafter the network traffic indicator measurement is obtained, or mayoccur in real-time while the network traffic probe 122 is acquiring thenetwork traffic indicator measurement. Other timings for exposing thenetwork traffic indicator measurement are also possible. In oneimplementation, a network probe exposing agent component of the networktraffic probe 122 exposes the network traffic indicator measurement viaa network traffic protocol. For example, the network probe exposingagent component may expose the network traffic indicator measurement viaa network traffic protocol, such as SNMP.

In addition to monitoring the input network traffic flows 118 and theoutput network traffic flows 120, the monitoring layer 104 may alsomonitor the internal operations of the network nodes 114-116 via anetwork node probe 124 in communication with the network nodes 114-116and monitoring layer 104. The network node probe 124 may be implementedin computer hardware, software, or a combination of computer hardwareand software. In one implementation, the network node probe 124 isimplemented in software and includes a statistic generator and a networkprobe exposing agent.

As changes in input network traffic flows 118 and output network trafficflows 120 may not be fully indicative of the stability status of thenetwork nodes 114-116, the network node probe 124 provides internaloperation information of the network nodes 114-116, such as systeminformation relating directly to the network nodes 114-116. For example,the network node probe 124 may provide such information as the number ofcomputing cycles, the amount of free memory available to the networknodes 114-116, the amount of memory used by the network nodes 114-116,and other similar system information. By providing the systeminformation to the monitoring layer 104, the network real-timemonitoring and control system 102 can better account for the stabilitystatus of the network nodes 114-116.

As another example, the monitoring layer 104 may also be incommunication with operation support systems 128-130. In general, anoperation support system supports processes such as maintaining networkinventory, provisioning services, configuring network components, andmanaging faults. Alternatively, or in addition, the monitoring layer 104may also communicate with one or more business support system thatsupport processes such as taking orders, processing bills, andcollecting payments. The monitoring layer 104 may communicate with theoperation support systems or business support systems to send or receiveinformation regarding node configuration, provisioning information,performance information, or other types of information.

The network traffic indicator measurements received by the monitoringlayer 104 are stored for later retrieval by an event control layer 106.The structure of the event control layer 106 is explained later withreference to FIG. 3, but, in summary, the event control layer 106generates a network event identifier by comparing a retrieved networktraffic indicator measurement with a network traffic indicatorthreshold. In general, a network event identifier identifies an event.Examples of events are discussed with reference to FIG. 3.

In addition, the event control layer 106 correlates the generatednetwork event identifier with a network node status identifier.Correlating the generated network event identifier with the network nodestatus identifier serves as one mechanism by which the event controllayer 106 can determine the status of the network nodes 114-116. Ingeneral, correlating may including identifying the network node statusidentifier based on the generated network event identifier, matching thenetwork node status identifier with the generated network eventidentifier, or otherwise determining the network node status identifierfrom the generated network event identifier.

With the status of the network node identified by the network nodestatus identifier, the event control layer 106 may then generate arequest for a network traffic shaping control. In general, a networktraffic shaping control includes instructions and parameters to shape anetwork traffic flow. However, a network traffic shaping control maycontrol additional actions other than traffic shaping actions. Examplesof parameters that define a network traffic shaping control include anInternet traffic protocol, a message type, a source address, adestination address, and a network traffic shaping control intensitythat identifies the amount of allowed network traffic. The networktraffic shaping control intensity may identify an absolute value of themaximum allowed traffic, an absolute value of the minimum allowedtraffic, or other value. However, a network traffic shaping control maydefine additional parameters.

The event control layer 106 communicates the network traffic shapingcontrol request to the traffic shaping control layer 108. The trafficshaping control layer 108 then implements a network traffic shapingcontrol according to the network traffic shaping control request. Withthe implemented network traffic shaping control, the traffic shapingcontrol 108 then controls the shaping of the network traffic flow.

The network real-time monitoring and control system 102 may also includelayers for reporting and administrative functions. For example, in oneimplementation, the network real-time monitoring and control system 102includes a reporting layer 110 that handles the reporting functions ofthe network real-time monitoring and control system 102. The reportinglayer 110 may include output and input functions to provide input andoutput to a user via graphical user interface, or to provide input andoutput to another system in communication with the network real-timemonitoring and control system 102.

Similarly, the network real-time monitoring and control system 102 mayinclude an administrative layer 112 that handles administrativefunctions of the network real-time monitoring and control system 102.The administrative layer 112 may include output and input functions toprovide input and output to a user via graphical user interface, or toprovide input and output to another system in communication with thenetwork real-time monitoring and control system 102.

Turning next to FIG. 2 is one example of the monitoring layer 104 of thenetwork real-time monitoring and control system 102 shown in FIG. 1. Themonitoring layer 104 may be implemented in hardware or software. As oneexample of a software implementation, the monitoring layer 104 may beimplemented in the Java programming language as OpenNMS, which is anenterprise-grade network monitoring platform developed under an opensource software model. OpenNMS is available from The OpenNMS Group,Inc., located in Pittsboro, N.C., United States.

In one implementation, the monitoring layer 102 includes a real-timenetwork monitor 202 in communication with the network traffic probe 122and the network node probe 124. The real-time monitor 202 monitors oneor more of the traffic flows in communication with the network trafficprobe 122. The real-time monitor 202 may monitor input traffic flows118, output traffic flows 120, or other traffic flows. The monitoredtraffic flows may be for the same network node or different networknodes. As a first example, the real-time network monitor 202 monitors afirst and second network traffic flow for a first network traffic node.As a second example, the real-time network monitor 202 monitors a firstnetwork traffic flow for a first network traffic node, and a secondnetwork traffic flow for a second network traffic node. Other examplesand scenarios are also possible.

In monitoring the input and output network traffic flows 118-120,network real-time monitor 202 monitors one or more network trafficindicators associated with a respective network traffic flow. Thenetwork real-time monitor 202 may monitor the network traffic indicatorsvia the network traffic probe 122. As previously mentioned, examples ofnetwork traffic indicators a signaling indicators, media treatmentindicators, provisioning indicators, and other types of network trafficindicators.

By monitoring the network traffic indicators, the real-time networkmonitor 202 obtains a monitored network traffic indicator measurementthat provides a measurement of the network traffic indicator for anetwork node. The real-time network monitor 202 may monitor networktraffic input indicators, network traffic output indicators, or acombination of network traffic input and network traffic outputindicators.

In one implementation, the input network traffic flow 118 monitored bythe real-time network monitor 202 is SIP network traffic. Examples ofnetwork traffic input indicators associated with SIP network trafficinclude the throughput of SIP INVITE messages incoming to the networkprobes 114-116, the throughput of SIP REGISTER messages incoming to thenetwork probes 114-116, and the number of re-transmitted SIP REGISTERmessages. As discussed below with reference to FIG. 3, a monitorednetwork traffic input indicator measurement, such as the measurement ofthe throughput of SIP INVITE messages incoming to the network probes114-116, may be used to calculate a network performance measurement.Table 1 describes exemplary network traffic input indicators.

TABLE 1 Network Traffic Input Indicator Type Description Throughput Thenumber of SIP messages. Throughput The number of SIP REGISTER messages.Throughput The number of SIP INVITE messages. Throughput The number ofre-transmitted messages. Throughput The number of re-transmitted SIPREGISTER messages. Throughput The number of re-transmitted SIP INVITEmessages. Syntax and Semantic Percentage of the number of malformedrequests.

In addition to network traffic input indicators, the real-time networkmonitor 202 may monitor network traffic output indicators associatedwith one or more output network traffic flows 120. Using SIP networktraffic as an example, the real-time network monitor 202 may monitorsuch network traffic output indicators as the response time to answerSIP INVITE messages output from a network node, the response time toanswer SIP REGISTER messages output from a network node, or anothernetwork traffic output indicators. Table 2 below describes exemplarynetwork traffic output indicators.

TABLE 2 Network Traffic Output Indicator Type Description Throughput Thenumber of SIP messages. Throughput The number of SIP REGISTER messages.Throughput The number of SIP INVITE messages. Syntax and SemanticPercentage of the number of messages that are redirection or failureresponses. Syntax and Semantic Percentage of the number of malformedrequests. Response Time The maximum response time at the 95th percentilefor SIP messages. Transmission Quality The mean packet loss for anestablished SIP session. Transmission Quality The mean packet delay foran established SIP session.

In determining response time for the network traffic output indicators,the real-time network monitor 202 may monitor for incoming messageshaving a specific payload. For example, to determine the response timefor SIP INVITE messages output from a network node, the real-timenetwork monitor 202 may monitor for response messages having a specificSIP status code, such as an SIP status code of 180 (“Ringing”), 183(“Session Progress”), 200 (“OK”), or other SIP status code.Alternatively, the real-time network monitor 202 may monitor forresponse messages having a range of SIP status codes, such as SIP statuscodes in the range of 300-699. Similarly, to determine the response timeto answer SIP REGISTER messages, the real-time network monitor 202 maymonitor for response messages having a specific SIP status code, orresponse messages having an SIP status code from a range of SIP statuscodes, such as SIP status codes in the range of 200-699.

By monitoring network traffic indicators, the real-time network monitor202 can keep the real-time monitoring and control system 102 informed asto whether the network nodes 114-116 are meeting the network needs ofthe network traffic flows 118-120. Moreover, the real-time monitoringand control system 102 can use the network traffic indicatormeasurements to determine the stability status of the network nodes114-116. Fluctuations in network traffic indicator measurements mayindicate that one or more network nodes 114-116 are experiencinginstability, an increase or decrease in network traffic, or that one ofthe network nodes 114-116 is about to suffer an outage.

In addition to network traffic indicators, the real-time network monitor202 may also monitor network node operational indicators via networknode probe 124. As monitoring the network traffic flows 118-120 may notprovide complete information relating to the stability status of thenetwork nodes 114-116, the monitored network node operational indicatorsprovide information relating directly to the network nodes 114-116.Examples of monitored network node operational indicators include theidle CPU quantity, the quantity of CPU used by the kernel of the networknode, the quantity of CPU used by user processes of the network node,the quantity of CPU used by processes waiting for input/outputresources, the quantity of CPU used to verify interrupts, the totalquantity of memory installed, the total quantity of available memory,the number of requests on a database, or other operational indicators.The operational indicator measurements of the operational indicators maybe used to calculate additional measurements, such as time-derivativemeasurements. Furthermore, monitoring the network node operationalindicators provides an indication as to the stability status of thenetwork node that may not be apparent from monitoring the networktraffic indicators. Table 3 below describes exemplary network nodeoperational indicators.

TABLE 3 Network Node Operational Indicator Type Description BasicSoftware The quantity of idle CPU usage. Basic Software The quantity ofCPU usage used by kernel. Basic Software The quantity of CPU usage usedby user processes. Basic Software The quantity of CPU usage used byprocesses waiting for input/output resources. Basic Software Thequantity of CPU usage used to verify interrupts. Basic Software Thequantity of available memory. Basic Software The quantity of memory inuse. Basic Software The number of open sockets. Middleware The number ofactive threads. Middleware The number of running processes. MiddlewareThe number of errors. Middleware The number of exceptions. ApplicationThe number of active network nodes on the network. Application Thenumber of inactive network nodes on the network. Application The totalnumber of network nodes on the network.

The real-time network monitor 202 includes several components tofacilitate the monitoring of the network traffic indicators and networknode operational indicators. In one implementation, the real-timenetwork monitor 202 includes a measurement manager 204, a measurementETL manager 206, and a monitored network traffic database 208. Themeasurement manager 204 may manage the measurement and monitoring of thenetwork traffic indicators and the network node operational indicators.In addition, the measurement manager 204 may also handle communicationsand message passing with the event control layer 106. The measurementETL manager 206 manages the manipulation of the network trafficindicator measurements and the network node operational indicatormeasurements. For example, the measurement ETL manager 206 may receivethe indicator measurements from the network traffic probe 122 and thenetwork node probe 124, transform the indicator measurements to fitwithin an expected format or other construct, and populate the monitorednetwork traffic database 208 with the indicator measurements.Furthermore, the measurement ETL manager 206 may operate in conjunctionwith the measurement manager 204 to extract the indicator measurementsfrom the monitored network traffic database 208 and communicate theindicator measurements to the event control layer 106.

The components of the monitoring layer 104 may be implemented insoftware, hardware, or a combination of hardware and software. Forexample, the components of the real-time network monitor 202, such asthe measurement manager 204 and measurement ETL manager 206, may beimplemented in software. In one implementation, the measurement manager204 and the measurement ETL manager 206 are implemented as computersoftware daemons, including a poller daemon, a discovery daemon, acapture service daemon, and a collect daemon. However, alternative oradditional daemons are also possible.

Each of the real-time network monitor daemons may be configured toperform one or more specific operations. For example, the poller daemonmay be configured to verify the connection with the network nodes114-116 using one or more network traffic protocols, such as InternetControl Message Protocol (“ICMP”), SNMP, or other network trafficprotocols. As another example, the discovery daemon may be configured todiscover new network nodes that have been added to the network. As yetanother example, the capture service daemon may be configured todiscover services exposed by the network nodes 114-116, discoverservices exposed by the probes 122-124, or other service discoveryoperations. The capture service daemon may be configured to discover theexposed services via a network traffic protocol, such as SNMP or otherprotocol. As a further example, the collect daemon may be configured tomonitor the network traffic indicators and obtain network trafficindicator measurements. The collect daemon may also be configured tomonitor network node operational indicators and obtain network nodeoperational indicator measurements. With each real-time network monitordaemon configured to perform a specific operation, the monitoring layer104 reduces the time it takes for the real-time network monitor 202 toobtain the network traffic indicator measurements and network nodeoperational indicator measurements.

The real-time network monitor 202 stores the monitored network trafficindicator measurements and network node operational indicatormeasurements in a monitored network traffic database 208 incommunication with the real-time network monitor 202. In oneimplementation, the measurement ETL manager 206 obtains the indicatormeasurements from the network traffic probes 122 and network node probes124, and stores the indicator measurements in the monitored networktraffic database 208.

As the network traffic indicator measurements and network nodeoperational indicator measurements change over time due to fluctuationsin input network traffic, output network traffic, and available networknode system resources, the real-time network monitor 202 may beconfigured to store the indicator measurements in the monitored networktraffic database 208 at predefined time intervals, such as every 5milliseconds, every 10 seconds, or any other predefined time interval.By storing the indicator measurements at predefined time intervals, thereal-time network monitor 202 ensures that the indicator measurementsstored in the monitored network traffic database 208 are currentindicator measurements. By having access to current indicatormeasurements, the network real-time monitoring and control system 102can respond more readily to changes in the stability status of one ormore network nodes 114-116.

To store the indicator measurements at predefined time intervals, themonitored network traffic database 208 may be implemented as around-robin database. In general, a round-robin database describes adatabase in which time-series data is stored. Examples of time-seriesdata includes data such as network bandwidth, temperatures, free CPUcapacity, available program memory, and other data. A round-robindatabase may be configured to store the data in such a way that systemstorage footprint remains constant over time. A database configured as around-robin database avoids resource expensive purge jobs and reducescomplexity. An example of an available round-robin database is RRDtool,which is available from Oetiker+Partner AG, located in Olten,Switzerland. However, alternative databases may be used as the monitorednetwork traffic database 208, such as a relational database, ahierarchical database, network-model database, or other type ofdatabase.

FIG. 3 shows one example of the event control layer 106 of the networkreal-time monitoring and control system 102 shown in FIG. 1. The eventcontrol layer 106 may be implemented in computer hardware or software.One example of a computer software implementation of the event controllayer 106 is OpenNMS, which is available from The OpenNMS Group, Inc.,located in Pittsboro, N.C., United States.

The event control layer 106 may include several components anddatabases. In one implementation, the components of the event controllayer 106 include an event management layer 302, a real-time statusanalyzer 304, and a control management layer 306. The databases of theevent control layer 106 include a network performance and thresholdprofile database 308, an event log database 310, a control request logdatabase, 312, a control log database 314, a scoring database 316, and aservice model database 318. Other databases and components are alsopossible.

The databases 308-318 may be implemented as individual databases, astables of a larger database, or in any other configuration of databasesor as a single database. In one implementation, the databases 308-318are implemented as a single object-relational database managementsystem. An example of an object-relational database management system isPostgreSQL, which is available from the PostgreSQL Foundation located inArlington, Va., United States. However, other implementations of thedatabases 308-318 are also possible.

The event manager layer 302 is configured to generate a network eventidentifier that identifies an event. The event manager layer 302 is alsoconfigured to manage network event identifiers generated by other layersof the real-time monitoring and control system 102. In general, an eventmay indicate an incidence or occurrence that has happened. In addition,events may relate to changes in the network traffic flows 118-120,changes in the network traffic indicators, changes in network nodes,114-116, or other changes. The event manager layer 302 may communicatethe generated network event identifier to one or more components of thenetwork real-time monitoring and control system 102 to provide statusinformation or status updates. Moreover, the components of the networkreal-time monitoring and control system 102 may react to the networkevent identifiers generated by the event manager layer 302. For example,a network event identifier may be used to initiate a network trafficshaping control, or, as discussed with reference to FIGS. 8-10, tochange the state of a network traffic shaping control.

In one implementation, the event manager layer 302 includes an eventmanager 320, a Network Performance Indicator (“NPI”) manager 322, and afiltering and aggregation manager 324 to facilitate the generation ofnetwork event identifiers. The components of the event manager layer 302may be configured for specific operations. For example, the filteringand aggregation manager 324 may be configured to receive and filternetwork indicator measurements from the monitoring layer 104. Filteringthe network indicator measurements from the monitoring layer 104 mayensure that the event manager 320 or NPI manager 322 receives relevantnetwork traffic indicator measurements for generating network eventidentifiers, and that the event manager layer 302 is not overloaded withextraneous network traffic indicator measurements.

In one implementation, the filtering and aggregation manager 324 filterspredetermined network traffic indicator measurements. For example, thefiltering and aggregation manager 324 may be configured to filternetwork traffic indicator measurements associated with specific networktraffic, such as network traffic indicator measurements for ARP networktraffic. As another example, the filtering and aggregation manager 324may be configured to filter network traffic indicator measurementsassociated with a specific network traffic indicator, such as SIPREGISTER messages for an SIP network traffic flow. The filtering andaggregation manager 324 may further be configured to filter networktraffic indicator measurements associated with a network traffic flow orassociated with a network node. However, the filtering and aggregationmanager 324 may also be configured to receive any and all types ofnetwork traffic indicator measurements communicated by the monitoringlayer 304.

The NPI manager 322 is configured to generate network performancemeasurements based on network performance equations and the networkindicator measurements received from the monitoring layer 104. Ingeneral, a network performance measurement refers to a value that isderived from a network indicator measurement. In addition, a networkperformance measurement may be a time derivative measurement for anetwork indicator measurement. Alternatively, the network performancemeasurement may indicate a rate of change between network indicatormeasurements.

In one implementation, the NPI manager 322 is implemented as a computersoftware daemon, and generates the network performance measurements byreceiving the network indicator measurements from the monitored networktraffic database 208 and applying the network indicator measurements toa network performance equation retrieved from the network performanceand threshold profile database 308. In another implementation, thefiltering and aggregation manager 324 retrieves network indicatormeasurements from the monitored network traffic database 208 andcommunicates the retrieved network indicator measurements to the NPImanager 322. The NPI manager 322 may then execute the networkperformance equation to obtain a network performance measurement.

The NPI manager 322 may be configured to generate one or more types ofnetwork performance measurements. For example, the NPI manager 322 maygenerate network input performance measurements, network outputperformance measurements, network node performance measurements, orother network performance measurements. The NPI manger 322 may thenstore the generated network performance indicator in one or more of thedatabases 308-318. Alternatively, the NPI manager 322 may store thegenerate network performance indicator in a layer different than theevent control layer 106. For example, in one implementation, the NPImanager 322 stores the network performance measurement in the monitorednetwork traffic database 208 of the monitoring layer 104. In thisimplementation, the NPI manager 322 stores the network performancemeasurement in the monitored network traffic database 208 to ensure thatthe network performance measurement is the most current networkperformance measurement available to the network real-time monitoringand control system 102. The stored network performance measurement maythen be retrievable by any of the components in the monitoring layer104, the event control layer 106, traffic shaping control layer 108, orother layer.

The NPI manager 322 may generate network performance measurements thatcorrespond to the received network indicator measurements. For example,the NPI manager 322 may generate network input performance measurements,network output performance measurements, network node performancemeasurements, or other network performance measurements. Network inputperformance measurements may be based on network traffic input indicatormeasurements. Exemplary network input performance measurements include atime derivative measurement of throughput of SIP INVITE messagesincoming to a network node and a time derivative measurement ofthroughput of SIP REGISTER messages incoming to a network node.Similarly, network output performance measurements may be based onnetwork traffic output indicator measurements. Exemplary network outputperformance measurements include a time derivative measurement ofresponse time to answer SIP INVITE messages output from a network nodeand a time derivative measurement of response time to answer SIPREGISTER messages output from a network node. Likewise, network nodeperformance measurements may be based on network node operationalindicator measurements. Exemplary network node performance measurementsinclude a CPU percentage usage amount that indicates the percentage ofused CPU normalized for the number of processors in the networkreal-time monitoring and control system 102 and a memory percentageusage amount that indicates the percentage of memory used by the networkreal-time monitoring and control system 102. However, a network inputperformance measurement, a network output performance measurement, or anetwork node performance measurement may be based on any combination ofnetwork traffic input indicator measurements, network traffic outputindicator measurements, and network node operational indicatormeasurements.

Similar to the network indicator measurements, the NPI manager 322 maygenerate the network performance measurements according to a predefinedtime interval. The predefined time interval for generating the networkperformance measurement may be the same as, or different than, thepredefined time interval for generating the network indicatormeasurements. In addition, the predefined time interval for generatingnetwork performance measurements may be differentiated according toindividual network performance measurements or network performancemeasurement type.

In addition, the network performance measurements may be differentiatedaccording to a differentiating schema. For example, the networkperformance measurements may be differentiated according to networktraffic flow, network node, or other differentiating schema.

In generating the network performance measurements, the NPI manager 322may retrieve one or more network performance equations from the networkperformance and threshold profile database 308. Table 4 below shows anexemplary network performance and threshold profile database schema fordefining network performance equations in the network performance andthreshold profile database 308.

TABLE 4 Column Name Description ID_INDICATOR A unique indicator of thenetwork performance indicator. NAME A mnemonic name of the networkperformance indicator. DESCRIPTION A brief description of the networkperformance measurement defined by the network performance equation.ALAS_OPENNMS An identifier used to reference the network performanceequation. TYPOLOGY Describes the classification of the networkperformance measurement defined by the network performance equation.FUNCTION The network performance equation that defines the networkperformance measurement. NETWORK_NODE A unique identifier of the networknode the to which the network performance indicator refers. KPI_NODE Anidentifier that identifiers the network node where the networkperformance indicator is measured. ID_ANAG_INDICATORS A reference to thetype of indicators for the network performance indicator. ENABLED Anidentifier that indicates whether the network performance indicator isactive and calculated from the system.

A network performance and threshold profile database schema provides aflexible and convenient template for defining complex networkperformance equations that define network performance measurements.Table 5 shows one example of a network performance equation record thatdefines a network performance equation for determining a CPU percentageusage amount network node performance measurement.

TABLE 5 Parameter Name Description ID_INDICATOR 15 NAME SS_MIK05DESCRIPTION Percentage Used CPU ALIAS_OPENNMS percentageUsedCPU TYPOLOGYNPI FUNCTION 100 − A29/round ((A29 + A36 + A43 + A50 + A57 + A64)/100,3) NETWORK_NODE 20 KPI_NODE 20 ID_ANAG_INDICATORS  4 ENABLED TRUE

Table 6 shows one example of a network performance equation record thatdefines a network performance equation for determining

TABLE 6 Parameter Name Description ID_INDICATOR 22 NAME SS_MIK012DESCRIPTION Percentage of memory used by SIP SERVER ALIAS_OPENNMSpercentUsedMem TYPOLOGY NPI FUNCTION 100 * (1 − (A73/A72)) NETWORK_NODE20 KPI_NODE 37 ID_ANAG_INDICATORS  5 ENABLED TRUE

The NPI manager 322 evaluates the network performance equation stored inthe function field of the network performance record to generate thenetwork performance measurement. In addition, the values in the functionfield of Tables 5-6 refer to other network indicator measurements andnetwork performance measurements. Table 7 provides examples of thereferences referred by the function field of the network performanceequation.

TABLE 7 Function Field Parameter Variable Name Description A26ssCPURawIdle Number of CPU cycles while idle. A36 ssCPURawKernel Numberof CPU cycles used for the kernel. A43 ssCPURawSystem Number of CPUcycles used for the system. A50 ssCPURawUser Number of CPU cycles usedto execute user program. A57 ssCPURawWait Number of CPU cycles usedwhile waiting for input/output resources. A64 ssCPURawNice Number of CPUcycles used due to an interrupt. A72 N/A Amount of available physicalmemory on a server in the sampling moment. A73 N/A Amount of physicalmemory in server.

The event manager 320 uses the network performance measurements andnetwork indicator measurements to generate network event identifiers.The event manager 320 is also configured to handle the management ofnetwork event identifiers generated by other components of the networkreal-time monitoring and control system 102. The event manager 320provides a centralized component for handling network event identifiersthat may be generated by multiple components. Furthermore, the eventmanager 320 may be configured to communicate network event identifiersgenerated by a first component to a second component, where the secondcomponent relies on the network event identifier to perform a task oroperation. Hence, as components are added to the network real-timemonitoring and control system, added components may be configured tocommunicate with the event manager 320 or the event control layer 106directly rather than having to be configured with every component in thenetwork real-time monitoring and control system 102. With the eventmanager 320 configured to manage and log generated network eventidentifiers, the other components of the network real-time monitoringand control system 102 can be configured to perform operations withoutthe complex overhead of being configured to manage network eventidentifiers or unknown future components that may be added later to thenetwork real-time monitoring and control system 102.

The event manager 320 may be implemented as computer hardware, computersoftware, or both. In one implementation, the event manager 320 isimplemented as computer software daemon written in the Java computerprogramming language. The event manager 320 may be configured to listenfor data and notifications on a predefined TCP port and, in response tothe received data and notifications from the predefined TCP port,generate network event identifiers that are communicated to one or morecomponents of the event control layer 106. For example, the eventmanager 320 may communicate network event identifiers to the real-timestatus analyzer 304. As another example, the event manager 320 maycommunicate the network event identifiers to an event log database 310,which may then be accessed by other components of the event controllayer 106.

The network indicator measurements and network performance measurementsof the monitoring layer 104 are communicated to the event manager 320.In one implementation, the event manger 320 retrieves the networkindicator measurements and network performance measurements from themonitored network traffic database 208. In another implementation, thefiltering and aggregation manager 324 retrieves the network indicatormeasurements and network performance measurements from the monitorednetwork traffic database 208, and communicates the network indicatormeasurements and network performance measurements to the event manager320. The filtering and aggregation manager 324 may further filter theretrieved network indicator measurements and network performancemeasurements to communicate a predefined type of network indicatormeasurement and/or network performance measurement to the event manager320. However, the event manager 320 may also access other databases toretrieve the network performance measurements and network indicatormeasurements, such as any of the databases 308-318.

In one implementation, the network performance and threshold profiledatabase 308 may store a network performance threshold profile and anetwork indicator threshold profile. The network performance thresholdprofile may also be configured by a user or other system, such asthrough administrative layer 112. The network performance thresholdprofile may define network performance thresholds for one or morenetwork performance measurements. For example, the network performancethreshold profile may define network input performance thresholds fornetwork input performance measurements, network output performancethresholds for network output performance measurements, and network nodeperformance thresholds for network node performance measurements. Othernetwork performance thresholds are also possible. Similarly, the networkindicator threshold profile may define network indicator thresholds forone or more network indicator measurements. For example, the networkindicator threshold profile may define network traffic input indicatorthresholds for network traffic input indicator measurements, networktraffic output indicator thresholds for network traffic output indicatormeasurements, and network node operational indicator thresholds fornetwork node operational indicator measurements. Other types andcombinations of network performance thresholds and network indicatorthresholds are also possible. Furthermore, one or more networkperformance threshold profiles and one or more network indicatorthreshold profiles are also possible that define the network performancethresholds and network indicator thresholds, respectively.

In addition, the network performance threshold profile and the networkindicator threshold profile may distinguish between different types ofthresholds. For example, the profiles may define a warning threshold anda critical threshold. The warning threshold may be less than thecritical threshold. The warning threshold may be a threshold where oneor more network nodes are approaching an instability status. A criticalthreshold may be a threshold where one or more network nodes havereached an instability status. By defining and distinguishing warningthresholds and critical thresholds, the network real-time monitoring andcontrol system 102 can attempt to prevent one or more network nodes114-116 from reaching an instability status if a warning threshold hasbeen reached. In other words, the warning thresholds may serve as awarning to the network real-time monitoring and control system 102 thatone or more network nodes are about to become unstable.

The event manager 320 compares the network performance measurements andnetwork indicator measurements with the network performance thresholdsand network indicator thresholds, respectively, to generate networkevent identifiers. Network event identifiers may be implemented in acomputer markup language, such as the Extensible Markup Language(“XML”). However, other computer languages that use a set of annotationsto text that give instructions regarding the structure of text or how itis to be displayed may also be used.

The event manager 320 may be configured to generate a network eventidentifier based on a comparison of the network performance measurementwith a network performance threshold, such as when the networkperformance measurement exceeds or falls below the network performancethreshold. Similarly, the event manager 320 may be configured togenerate a network event identifier based on a comparison of a networkindicator measurement with a network indicator threshold, such as when anetwork indicator measurement exceeds or falls below a network indicatorthreshold. As one example, the event manager 320 may generate a networkevent identifier when a network traffic input indicator measurement,such as the number of SIP REGISTER messages received by a network node,exceeds a network traffic input indicator threshold, such as a totalnumber of SIP REGISTER messages that can be received by the networknode. As another example, the event manager 320 may generate a networkevent identifier when a network input performance measurement, such asthe time derivative measurement of SIP REGISTER messages received by anetwork node, exceeds a network input performance threshold, such as themaximum rate at which the network node can receive SIP REGISTERmessages.

Moreover, the event manager 320 may generate a network event identifieraccording to a combination of comparative measurements of networkindicator thresholds and/or network performance thresholds. For example,the event manger 320 may generate a network event identifier when afirst network input performance threshold is exceeded and a secondnetwork input performance threshold is exceeded. As another example, theevent manager 320 may generate a network event identifier when a firstnetwork input performance threshold is exceeded and a first network nodeoperational indicator threshold is exceeded. Other comparativecombinations are also possible.

In general, the event manager 302 may be configured to generate any typeof network event identifier. Table 8 below lists exemplary network eventidentifiers accompanied by corresponding descriptions.

TABLE 8 Network event identifier Description EVENT_FINE_CONTR_OUT_SONDAIdentifies an event for automatically terminating a network trafficshaping control due to a network probe outage.EVENT_FINE_CONTR_OUT_SONDA_KO Identifies an event where the controllogic associated with the network event identifierEVENT_FINE_CONTR_OUT_SONDA has raised an error.EVENT_FINE_CONTR_OUT_SONDA_OK Identifies an event where the controllogic associated with the network event identifierEVENT_FINE_CONTR_OUT_SONDA has correctly executed. EVENT_FINE_CONTR_RTCIdentifies an event where the network traffic shaping control should beterminated automatically. EVENT_FINE_CONTR_RTC_KO Identifies an eventwhere the control logic associated with the network event identifierEVENT_FINE_CONTR_RTC has raised an error. EVENT_FINE_CONTR_RTC_OKIdentifies an event where the control logic associated to the networkevent identifier EVENT_FINE_CONTR_RTC has correctly executed.EVENT_FINE_CONTR_RTC_OUT_SONDA Identifies an event where a networktraffic shaping control should be automatically deleted due to an outageof a network probe. EVENT_NODE_UP Identifies an event where a networknode is active and reachable. EVENT_NODE_UP_KO Identifies an event wherethe control logic associated with the network event identifierEVENT_NODE_UP has raised an error. EVENT_NODE_UP_OK Identifies an eventwhere the control logic associated with the network event identifierEVENT_NODE_UP correctly executed. EVENT_NOTIF_OUT_ISTANZA_SERVERIdentifies an event for an outage of a server instance that may benotified. EVENT_NOTIF_OUT_SONDA Identifies an event for an outage of theprobes for notification. EVENT_NOTIF_THR Identifies an event for anexceeding/rearmed threshold for a particular indicator/NPI that may benotified. EVENT_SUGG_CONTR Identifies an event where a network trafficshaping control has been suggested. EVENT_THR Identifies an event for anexceeding/rearmed threshold for a particular indicator/NPIEVENT_USR_ACC_CONTR Identifies an event where a network traffic shapingcontrol has been accepted. EVENT_USR_ACC_CONTR_KO Identifies an eventwhere the control logic with the network event identifierEVENT_USR_ACC_CONTR has raised an error. EVENT_USR_ACC_CONTR_OKIdentifies an event where the control logic associated with the networkevent identifier EVENT_USR_ACC_CONTR has been correctly executed.EVENT_USR_ANN_CONTR Identifies an event where a network traffic shapingcontrol has been canceled. EVENT_USR_TERM_CONTR Identifies an eventwhere a network traffic shaping control has been terminated.EVENT_USR_TERM_CONTR_OK Identifies an event where the control logicassociated with the network event identifier EVENT_USR_TERM_CONTR hasbeen correctly executed.

The control logic referred to by Table 8 may be implemented by one ormore of the components 302-306 of the event control layer 106. Forexample, the control logic may be implemented by the real-time statusanalyzer 304 and control management layer 306. Alternatively, thecontrol logic may be implemented by the filtering and aggregationmanager 324, the control selector 330, and the control manager 332.Alternative implementations of the control logic are also possible.

In addition to generating network event identifiers based on comparisonsof network performance thresholds and network indicator thresholds, theevent manager 320 may be configured to manage network event identifiersgenerated from other components of the real-time monitoring and controlsystem 102, such as from the monitoring layer 104. For example, theevent manager 302 may receive a network event identifier from themonitoring layer 104 regarding the status of a network node. The networkevent identifier may indicate that the network node is active andreachable. In this example, the event manager 302 may receive anEVENT_NODE_UP network event identifier. As another example, the eventmanager 302 may receive a network event identifier regarding the statusof a network probe, such as the network traffic probe 122 or the networknode probe 124. The network event identifier may indicate that thenetwork probe has failed or has suffered an outage. Where the networkprobe has failed or has suffered an outage, the event manager 302 mayreceive an EVENT_FINE_CONTR_OUT_SONDA network event identifier. Othertypes of network event identifiers are also possible.

The event manager 302 may communicate the generated network eventidentifiers to the real-time status analyzer 304. The real-time statusanalyzer 304 handles the generation of requests for a network trafficshaping control. The real-time status analyzer 304 may be implemented incomputer hardware or computer software. In one implementation, real-timestatus analyzer 304 is implemented as an event receiver queue, acomputer software thread containing a network event identifier hashtable, and a main control thread. The event receiver queue is configuredto receive network event identifiers from the event manager 320 anddistribute the network event identifiers to the real-time status manager324 and the real-time event correlator 326. The event receiver queue maybe implemented as a Java Message Service (“JMS”) queue deployed in aJBoss application server. The JBoss application server is available fromJBoss, which is a division of Red Hat, and located in Atlanta, Ga.,United States. The computer software thread containing the network eventidentifier hash table contains hashes of all the events associated witha network node. The filtering and aggregation manager 324 and thereal-time event correlator 326 may store network state identifiers inthe hash table, and when a change in state is requested, the maincontrol thread communicates requests for network traffic shapingcontrols to the control management layer 306. In one implementation, thereal-time status manager 324 is the main control thread.

The real-time status analyzer 304 includes a real-time event manager 324and the real-time event correlator 326. The real-time event correlator326 correlates the network event identifier with a network node statusidentifier that identifies the status of the network node associatedwith the network event identifier. As a network event identifier may notspecify the stability status of a network node, the configuration of thereal-time event correlator 326 facilitates the identification of aninstability status given a network event identifier. Moreover, as thecorrelation of a single network event identifier may not identify aninstability status, the real-time event correlator 326 may be configuredto correlate multiple network event identifiers with a single networknode status identifier. Hence, as different network event identifiersare generated across the components of the network real-time monitoringand control system 102, the real-time event correlator 326 simplifiesthe task of identifying an instability status.

In one implementation, the real-time event correlator 326 interacts withthe service model database 318 to correlate network event identifierswith a network node. The real-time correlator may be implemented as amessenger queue, such as a JMS queue, deployed on a JBoss applicationserver and as a software thread that contains the status of a networknode. Alternatively, or in addition, the real-time event correlator 326may include a business rules engine or other software that executesrules to make decisions. The real-time event correlator 326 may furtherinclude facts and assertions for executing the rules, and the facts andassertions may comprise network event identifiers, network indicatormeasurements, network performance measurements, and other facts andassertions. The real-time event correlator 326 may receive one or morenetwork event identifiers from one or more layers 104-112, such as themonitoring layer 104 or the event control layer 106, using the JMSqueue, and then interacts with the service model database 318 based onthe received network event identifier. The real-time event correlator326 may also be implemented as part of a JMS queue controller and a Javaclass logic.

The real-time status manager 324 generates a request for a networktraffic shaping control based on the correlation of the network eventidentifier with the network node status identifier. The real-time statusanalyzer 324 may also communicate one or more network event identifiersto the event manager 302 that identifies the actions taken by thereal-time status analyzer 324.

The real-time event correlator 326 may correlate network eventidentifiers with a network node status identifier according to apredefined node status rule set. The real-time event correlator 326receives network event identifiers and, based on the status of one ormore indicators for a network node, identifies a potential beginning ofnetwork node instability. The real-time event correlator 326 may referto the service model database 318 to correlate the network eventidentifier with the network node and with the real-time status manager324.

FIG. 4 shows an example of a node status rule set 402. The network nodestatus rule set 402 may be implemented in any number of computerhardware or computer software technologies. As one example, the networknode status rule set 402 is implemented in Microsoft Excel, which isavailable from the Microsoft Corporation, located in Redmond, Wash.,United States.

The node status rule set 402 may include node status rule componentssuch as one or more of a network node status identifier 404, a networknode status condition 406, a network node status condition priority 408,and a network node status scenario 410. Alternative node status rulecomponents are also possible.

The network node status identifier 404 identifies an instability statusof one or more of the network nodes 114-116. As shown in FIG. 4, thenode status rule set 402 includes six network node status identifiers404 labeled as R1, R2, R3, R4, R5, and R6 to identify status of anetwork node. The node status rule set 402 may be used to identify aninstability status of any of the network nodes 114-116. A single nodestatus rule set 402 may associated with all of the network nodes114-116. Alternatively, each network node 114-116 may be associated withits own node status rule set 402. The node status rule set 402 mayinclude alternative network node status identifiers than those shown inFIG. 4.

Each network node status identifiers 404 is associated with a networknode status condition 406. A network node status condition 406 may beone or more conditions that are satisfied according to one or morenetwork event identifiers. As a network node status condition 406 may besatisfied based on one or more network event identifiers, the networknode status condition 406 provides a streamlined mechanism forevaluating complex and disparate network event identifiers.

Using a network event identifier, the real-time event correlator 326attempts to evaluate and/or satisfy the network node status conditions406. When a network node status condition 406 is satisfied, theassociated network node status identifier 404 is identified. As a firstexample, where the network event identifier identifies that an inputindicator threshold, such as an input SIP INVITE critical threshold, hasbeen exceeded, the real-time event correlator 326 identifies that thenetwork node status condition 406 associated with the node statusidentifier R1 has been satisfied. Hence, the real-time event correlator326 correlates the network event identifier associated with an exceededinput SIP INVITE critical threshold with the network instability statusidentifier R1. As a second example, where a one or network eventidentifiers identify that one or more input indicator thresholds, suchas an input SIP REGISTER warning threshold, have been exceeded and twoor more network event identifiers identify that two or more networkperformance measurement warning thresholds have been exceeded, thereal-time event correlator 326 identifies that the network node statuscondition 406 associated with the node status identifier R4 has beensatisfied. Hence, in this second example, the real-time event correlator326 correlates network event identifiers with the network instabilitystatus identifier R4.

The node status rule set 402 also includes a network node statuscondition priority 408. The network node status condition priority 408indicates a priority level associated with a corresponding network nodestatus condition 406. The network node status condition priority 408 maybe different for each network node status conditions 406. Alternatively,two or more network node status conditions 406 may have the same networknode status condition priority 408.

The real-time event correlator 326 may be configured to evaluate thenetwork node status condition 406 according to its associated prioritylevel identified by the network node status condition priority 408. Forexample, as shown in FIG. 4, the real-time event correlator 326 mayevaluate the R2 network node status condition, which as the highestlevel priority, first; the R1 network node status condition second; theR6 network node status condition third; the R5 network node statuscondition fifth; and the R3 network node status condition, which has thelowest level priority, sixth. Because the network node status conditionpriorities 408 identify a priority level of the network node statusconditions 406, the network node status condition priorities 408establish a priority order in which network traffic shaping controls areapplied to network traffic flows and/or network nodes. In somecircumstances, there may be uncertainties as to which network trafficshaping control to apply first. Hence, the network node status priority408 assists in the resolution of conflicts among simultaneouslysatisfied network node status conditions 408. In addition, the networknode status condition priority 408 facilitates the evaluation of anetwork node status condition that may be considered more severe thanother network node status conditions. Accordingly, the network real-timemonitoring and control system 102 can take quicker action to implement anetwork traffic shaping control where a network node status conditionwith a high priority is satisfied by generated network node networkevent identifiers.

The node status rule set 402 may also include a node status scenario410. In one implementation, the node status scenario 410 describes thesystem situation under which the network node status condition 406 hasbeen satisfied. The node status scenario 410 may provide systeminformation, network node information, network traffic flow information,or other information. Furthermore, the node status scenario 410 may bedisplayed on a graphical user interface or other output interface, suchas a printer or audio speaker. For example, where the R2 network nodestatus condition is satisfied, the real-time event correlator 326 maycommunicate the R2 node status scenario 410 to the reporting layer 110for outputting to a display or other system or device.

Referring back to FIG. 3, when a network node status condition 406 issatisfied, the real-time event correlator 326 may communicate thenetwork node status identifier to the real-time status manager 324.Alternatively, the real-time event correlator 326 may generate a networkevent identifier indicating the identified network node statusidentifier, and may communicate the generated network event identifierto the event manager 320 for further processing. Hence, the real-timestatus manager 324 may receive the network node status identifier via acomponent other than the real-time event correlator 326, such as theevent manager 320.

Based on the correlation of the network event identifier with thenetwork node status identifier, the real-time status manager 324 maygenerate a request for a network traffic shaping control. In oneimplementation, the real-time status manager 324 communicates therequest for a network traffic shaping control to a control request logdatabase 312. The request for the network traffic shaping control may beread from the control request log database 312 from one or morecomponents, such as the control management layer 306. In anotherimplementation, the real-time status manager 324 generates a networkevent identifier that contains a request for a network traffic shapingcontrol and communicates the network event identifier to the eventmanagement layer 302. The network event identifier containing therequest for the network traffic shaping control may then be stored onthe monitored network traffic database 208 and retrievable by any of thecomponents of the network real-time monitoring and control system 102.

The control management layer 306 may receive the request for a networktraffic shaping control from the monitored network traffic database 208,the real-time status analyzer 304, or any other component of the networkreal-time monitoring and control system 102. In one implementation, thecontrol management layer 306 is implemented as part of the JBossapplication server, which is available from JBoss, a division of RedHat. The control management layer 306 may define a main control nodethread and a control management thread. The main control node thread maybe configured to generate the network traffic shaping control. The maincontrol node thread may then communicate the generated network trafficshaping control to the control management thread.

The control management thread manages network traffic shaping controls.Managing a network traffic shaping control may include sending a networkevent identifier to the event management layer 302 that notifies theevent management layer 302 of the generated control, and managing thelife cycle of the network traffic control as the network traffic controltransitions between one or more states based on generated network eventidentifiers. Managing the network traffic shaping control may alsoinclude terminating the network traffic shaping control based on apredefined condition, such as when a network node becomes stable or whena received termination request to terminate the network traffic shapingcontrol is received.

The control management layer 306 may include one or more components tofacilitate the generation and management of network traffic shapingcontrols. In one implementation, the control management layer 306includes a root cause identifier 328, a control selector 330, and acontrol manager 332. Alternative components are also possible.

The control manager 332 initially receives the request for the networktraffic shaping control. Where the control manager 332 receives multiplerequests for network traffic shaping controls, the control manager 332communicates with the root cause identifier 328 to prioritize whichnetwork traffic flow is considered first.

In one implementation, the root cause identifier 328 assigns prioritylevels to one or more network traffic flows in deciding which networktraffic flows should receive a network traffic shaping control. The rootcause identifier 328 may communicate with a scoring database 316 toapply a network traffic scoring function to one or more of the inputnetwork traffic flows 118 to obtain a priority level for eachcorresponding input network traffic flow 118. In general, a networktraffic scoring function is a function that identifies the networktraffic flow priority for a corresponding network traffic flow. Forexample, the root cause identifier 328 may use one or more networktraffic scoring functions to determine network traffic flow prioritiesamong one or more input network traffic flows 118 or output networktraffic flows 120.

As mentioned above, a network traffic flow priority identifies a networktraffic flow priority level for a network traffic flow. The networktraffic flow priority level assigned to a corresponding network trafficflow may determine whether a network traffic shaping control is appliedto the corresponding network traffic flow. Each of the network trafficflows of the network nodes 114-116 may be assigned a network trafficflow priority. For example, when there are no indications on a networktraffic flow to shape, the root cause identifier 328 may apply thenetwork traffic scoring function to identify a candidate network trafficflow that has less impact on the overall service for one or more networknodes 114-116. Assigning a network traffic flow priority may beperformed based on the service impact of the network traffic flow andthe transactional computing weight.

The term “transaction computing weight” refers to the amount ofcomputing resources required to process a transaction. Computingresources may include processor cycles, an amount of memory, availableinput or output devices, or any other type of computing resources. Inone example, the network real-time monitoring and control system 102 mayimplement a first method and a second method. Furthermore, in thisexample, the first method may require at least three queries of one ormore of the databases of the network real-time monitoring and controlsystem 102, whereas the second method may require only one query. Inthis example, the transaction computing weight for the first methodwould be greater than the transaction computing weight of the secondmethod, and the increased transaction computing weight may be taken intoaccount when a network traffic shaping control is suggested.

In addition, the root cause identifier 328 may use a network trafficscoring function by to determine network traffic flow priorities. In oneimplementation, the network traffic scoring function may use the networknode status condition priorities 408. The network traffic scoringfunction may be dependent on the transaction computing weight of one ormore network traffic flows.

The root cause identifier may retain the network traffic flow prioritylevel for a network traffic flow. In one implementation, the root causeidentifier 328 stores the network traffic flow priority in the scoringdatabase 316. However, the root cause identifier 328 may store thenetwork traffic flow priority in another database, such as the monitorednetwork traffic database 208.

The control selector 330 selects and/or generates the network trafficshaping control requested by the real-time status analyzer 304. Thecontrol selector 330 may be implemented as a business rules engine orother software system that executes one or more rules in a runtimeproduction environment. One example of a business rules engine is JBossRules, which is available from JBoss, which is a division of Red Hat.

As previously discussed, a network traffic shaping control includesinstructions and parameters to shape a network traffic flow. However, anetwork traffic shaping control may control additional actions otherthan network traffic shaping actions.

A network traffic shaping control may include one or more networktraffic shaping control parameters that define the network trafficshaping control. The network traffic shaping control parameters definethe actions to be taken when the network traffic shaping control isimplemented. Examples of network traffic shaping control parameters thatdefine a network traffic shaping control include an Internet trafficprotocol, a message type, a source address, a destination address, and anetwork traffic shaping control intensity that identifies the amount ofnetwork traffic to be received by a network node. The network trafficshaping control intensity may identify an absolute value of the maximumallowed traffic, an absolute value of the minimum allowed traffic, orother value. Alternative parameters may also define a network trafficshaping control.

To populate the parameters of the network traffic shaping control, thecontrol selector 330 may receive data from one or more databases of thenetwork real-time monitoring and control system 102. For example, thecontrol selector 330 may receive network indicator measurements and/ornetwork performance measurements from the monitored network trafficdatabase 208 to obtain current measurements relating to the operationalconditions of one or more network nodes 114-116, the operationalconditions of one or more network traffic flows, or a combination ofmeasurements: The monitoring layer 104 may include a networkcommunication interface based on an HTTP/XML protocol for receiving datafrom the monitored network traffic database 208.

In one implementation, the control selector 330 defines the networktraffic shaping control intensity. An exemplary function that defines anetwork traffic shaping control intensity is listed below:

${{SCI} = {\frac{{{Actual}\mspace{14mu} {Measurement}} - {{Rearm}\mspace{14mu} {Measurement}}}{{Actual}\mspace{14mu} {Measurement}} \times 100}},$

where:

SCI=the network traffic shaping control intensity;

Actual Measurement=the value of a network indicator measurement, networkperformance measurement, or other network measurement; and,

Rearm Measurement=value of a critical or warning threshold associatedwith the actual measurement.

The network traffic shaping control intensity function shown abovedefines network traffic shaping intensity as a percentage of networktraffic flow. For example, referring to FIG. 4, where the R1 networkstatus condition is satisfied, the network traffic shaping control maydefine that the network traffic flow associated with the R1 statusidentifier is reduced by 33%, or that the network traffic flowassociated with the R1 status identifier network traffic shaping controlintensity is reduced to 33% of the normal network traffic flow. Asanother example, where the R1 network status condition is satisfied, thenetwork traffic shaping control may define that the network traffic flowassociated with the R1 status identifier is reduced by 50%, or that thenetwork traffic flow associated with the R1 status identifier is reducedto 50% of the normal network traffic flow.

The variable values in the function defining a network traffic shapingcontrol intensity, such as the “Actual Measurement” variable value and“Rearm Measurement” variable value, may be based on the network statusidentifier and/or the request for a network traffic shaping control fromthe real-time status analyzer 304. For example, the “Rearm Measurement”variable value may be based on a critical threshold or warning thresholdassociated with the network measurement used to calculate the networktraffic shaping control intensity. Alternatively, one or more of thedatabases 308-318 may define the variables and/or variable values to usein defining the network traffic shaping control intensity.

The control selector 330 may then populate a primary network trafficshaping control record with the network traffic shaping controlparameter values of the network traffic shaping control intensity. Table9 below shows one example of network traffic shaping parameters that maydefine a primary network traffic shaping record.

TABLE 9 Network Traffic Shaping Parameter Description ID_CONTROL Aparameter that identifies an identification number of the networktraffic shaping control. ID_ANAG_CONTROLLO A parameter that identifiersthe type of the network traffic shaping control. ID_ANAG_CONTROLLO maybe used as a foreign key. TIMESTAMP_ARRIVAL A parameter that identifiesthe arrival time of the network traffic shaping control. TIMESTAMP_BEGINA parameter that identifies the time when the network traffic shapingcontrol begins execution. TIMESTAMP_END A parameter that identifies thetime when the network traffic shaping control ends execution. STATE Aparameter that identifies the state of the network traffic shapingcontrol. ID_NETWORK_NODE A parameter that identifies the network nodefor the network traffic shaping control. EVENTID A parameter thatidentifies an event identification number for the network trafficshaping control. XML_DATA A parameter that contains network trafficshaping control data. The network traffic shaping control data may bestored in an XML format. RIMODULATION A parameter that identifieswhether the network traffic shaping control is in modulation mode. Ingeneral, modulation mode indicates that once the control is started theintensity could be automatically adjusted depending on the new values ofthe measures of the indicators.

The control selector 330 may also populate a network traffic shapingcontrol intensity record with network traffic shaping control parametervalues. Table 10 below shows one example of the parameters for a networktraffic shaping control intensity record.

TABLE 10 Network Traffic Shaping Parameter DescriptionID_DETTAGLIO_CONTROLLO A parameter that identifies the secondary networktraffic shaping control record. ID_CONTROL A parameter that identifiesthe primary network traffic shaping control record. INTENSITY Aparameter that identifies the intensity of the network traffic shapingcontrol. ID_FLUSSO A parameter that identifies the network traffic flowto which the network traffic shaping control should be applied.

The primary network traffic shaping control record and the networktraffic shaping control intensity record may be stored in one or moredatabases of the network real-time monitoring and control system 102.For example, the primary network traffic shaping control record and thenetwork traffic shaping control intensity record may be stored in theservice model database 318, the monitored network traffic database 208,or any of the other databases 308-318.

The control selector 330 may communicate the network traffic shapingcontrol to the control manager 332 to notify the network real-timemonitoring and control system 102 that a network traffic shaping controlhas been generated. In one implementation, the network traffic shapingcontrol is sent as part of a network event identifier to the eventmanager 320. An example of an network event identifier that incorporatesa network traffic shaping control is shown below as implemented in XML:

<?xml version=“1.0” encoding=“UTF-8”?> <logxmlns=“http://xmlns.opennms.org/xsd/event”> <events><event uuid=“110”><uei xmlns=“”>controller/sv_suggestControl</uei> <sourcexmlns=“”>ruleEngine</source> <time xmlns=“”>Wednesday, October 31, 20075:00:54 PM CET</time> <service xmlns=“”>ruleEngine</service> <parms><parm> <parmName xmlns=“”>idNetworkNode</parmName> <value type=“string”encoding=“text”>20<value> </parm> <parm> <parmNamexmlns=“”>RuleName</parmName> <value type=“string”encoding=“text”>R1</value> </parm> <parm> <parmNamexmlns=“”>RuleDescription</parmName> <value type=“string”encoding=“text”>Exceeding of a critical threshold for one or more inputindicators for SIP INVITE traffic flows </value> </parm> <parm><parmName xmlns=“”>xmlState</parmName> <value type=“string”encoding=“text”></value> </parm> <parm> <parmNamexmlns=“”>controlType</parmName> <value type=“string”encoding=“text”>P</value> </parm> <parm> <parmNamexmlns=“”>idAnagControllo</parmName> <value type=“string”encoding=“text”>2</value> </parm> <parm> <parmNamexmlns=“”>idIndicators</parmName> <value type=“string”encoding=“text”>2</value> </parm> <parm> <parmNamexmlns=“”>aliasIndicators</parmName> <value type=“string”encoding=“text”>inThrRegPisa</value> </parm> <parm> <parmNamexmlns=“”>idAnagFlusso</parmName> <value type=“string”encoding=“text”>2</value> </parm> <parm> <parmNamexmlns=“”>intensity</parmName> <value type=“string”encoding=“text”>33</value> </parm> <parm> <parmNamexmlns=“”>idFlows</parmName> <value type=“string”encoding=“text”>2</value> </parm> </parms> </event></events> </log>

In addition, the control manager 332 may maintain a log of the networktraffic shaping controls that have been generated. In oneimplementation, a log of the network traffic shaping controls ismaintained in the network traffic shaping control log database 314. Inaddition to the control manager 332, one or more components of thenetwork real-time monitoring and control system 102 may have access tothe network traffic shaping control log database 314.

After generating the network traffic shaping control, the controlmanager 332 may or may not automatically output the network trafficshaping control to the traffic shaping control layer 108. In oneimplementation, the output of the network traffic shaping control iscontrolled by a user of the network real-time monitoring and controlsystem 102. In this implementation, a determined network traffic shapingcontrol is a suggested network traffic shaping control because the userof the network real-time monitoring and control system 102 may havediscretion as to whether the suggested network traffic shaping controlis output to the traffic shaping control layer 108. For example, thecontrol manager 332 may communicate a control acceptance request thatrequests acceptance of the suggested network traffic shaping control tothe reporting layer 110, which, in turn, may be output to the user ofthe network real-time monitoring and control system 102. The controlmanager 332 may then hold the output of the suggested network trafficshaping control unit until the control manager 332 receives anacceptance acknowledgment of the suggested network traffic shapingcontrol. Alternatively, the control manager 332 may terminate thesuggested network traffic shaping control according to a predefinedtermination condition. For example, the control manager 332 mayterminate the suggested network traffic shaping control when the controlmanager receives a decline acknowledgement. By giving the userdiscretion as to which network traffic shaping controls are output tothe traffic shaping layer 108, the user may selectively apply thenetwork traffic shaping controls that the user believes to be mostdesirable or beneficial for the network nodes 114-116.

In an alternative implementation, the acceptance and output of thenetwork traffic shaping control is automatic. In this automaticimplementation, when the network traffic shaping control is generated,the control manager 332 automatically outputs the network trafficshaping control to the traffic shaping control layer 108.

In addition, the life cycle of a network traffic shaping control may becontrolled by the satisfaction of one or more conditions. For example, anetwork traffic shaping control may end when a terminating condition issatisfied. A terminating condition may be satisfied when a terminatingrequest to terminate the network traffic shaping control is receivedfrom a user, or may be based on a network event identifier received bythe control manager 332. Other conditions may include a finishingcondition, a stopping condition, a failing condition, and an abortingcondition. The conditions may be satisfied based on the occurrence of anetwork event identifier or the receipt of a user request.

As discussed below with reference to FIGS. 7-11, a network trafficshaping control may change to a state that ends the network trafficshaping control, and, by entering the state that ends the networktraffic shaping, a condition controlling the life cycle of the networktraffic shaping control may be satisfied.

In addition to the event management layer 302, the real-time analyzer304, and control manager layer 306, the event control layer 106 mayinclude a service model database 318 that stores a service model. Ingeneral, the service model provides a platform representation of a VoIPprovider through the definition of its elements and theirinterconnections. In one implementation, the event management layer 302communicates with the service model database 318 using Structured QueryLanguage (“SQL”) queries. The information retrieved from the servicemodel database 318 facilitates the correlation of an event with one ormore of the network nodes 114-116. The information retrieved from theservice model database 318 may include relations between a networkperformance measurement, or other measurements and the server instance,and the relations between network nodes and server instances. In oneimplementation, the information retrieved from the service modeldatabase 318 occurs according to a predetermined service modelcondition, such as when the service model is first introduced to thenetwork real-time monitoring and control system 102, when the servicemodel database 318 has been modified, or other predetermined servicemodel condition.

The real-time status analyzer 304 and the control management layer 306may communicate with the service model database 318. For example, thereal-time status manager 324 of the real-time time status analyzer 304may retrieve information the service model database 318 when apredetermined service model condition occurs or is satisfied. As anotherexample, the root cause identifier 328 of the control management layer306 may communicate with the service model database 318 to identify aroot cause of the event and to identify one or more input traffic flows118 or output traffic flows 120 to shape.

Other components of the network real-time monitoring and control system102 may also communicate with the service model database 318. Forexample, the administrative layer 112 may communicate with the servicemodel database 318. The administrative layer 112 may communicate withthe service model database 318 for initial configuration of the servicemodel or for later modifications of the service model database 318.Other interactions between the administrative layer 112 and the servicemodel database 318 are also possible.

FIG. 5 shows one example of a service model 502 stored in the servicemodel database 318. The service model 502 includes a platform root node504 that forms the root of the service model 502. The children andconnectors of the platform root node 504 identify the network nodes,network servers, network node services, network traffic flows, and otherentities that form the VoIP platform.

In the implementation shown in FIG. 5, the VoIP platform includes afirst service center node 506 and a second service center node 508. Theservice center nodes 506-508 represent primary points of connection fornetwork nodes. The service center nodes 506-508 may providetelecommunication services, such as VoIP service to one or more networknodes.

The network nodes of the service centers 506-508 are identified by nodetype. Examples of node types include an SIP server, a Home SubscriberServer (“HSS”), a softswitch, a media gateway, a session bordercontroller, or other node types. However, the network nodes of theservice center nodes 506-508 may be identified by other criteria, suchas geographic location, telecommunication service provided, or othercriteria. The first service center node 506 is identified as having twonetwork node types, a first network node type 510 and a second node type512. While the first network node type 510 does not have any childrennodes, the second node type 512 is identified as having at least twonetwork nodes

The network node types 510-512 may or may not have network nodes aschildren nodes. Although the first network node type 510 does not havechildren nodes, the second network node type 512 is identified as havingtwo children network nodes 514-516. The network nodes 514-516 may havesimilar children nodes. Children nodes of the network nodes 514-516include server instances, network traffic flows, executive services andnetwork node operational indicators. However, the children nodes of thenetwork nodes 514-516 may include other types of children nodes, such aschildren nodes for network traffic indicator measurements, networktraffic performance measurements, or other children nodes.

The second network node 516 is identified as having two network trafficflows 518-520. The network traffic flows 518-520 may be input networktraffic flows, output network traffic flows, or a combination of networktraffic flows. The second network node 516 is also identified as havinga first server instance node 522 and a second server instance node 524.In general, a server instance node identifies a computer softwareapplication or other program running on a physical computer. Forexample, an SIP server generally includes many different types of serverinstances, such as a load balancer, one or more servers installed indifferent server instances. A server instance node may identify the loadbalancer of the SIP server or one of the other server instancesinstalled on the SIP server. A server instance node may also identifyone or more server instances.

Like network nodes 514-516, a server instance node may have childrennodes. Children nodes of service instance nodes 522-524 may includeexecutive service nodes, indicator nodes, or other children nodes. Ingeneral, an executive service node identifies an executive service thatmay be integral to the service instance. Examples of executive servicesinclude operating systems, application server software, databasesoftware, or other executive service. As shown in FIG. 5, the firstserver instance node 522 has a first executive service node 526 and asecond executive service node 528. Although the second server instancenode 524 is not shown with executive service nodes, executive servicenodes are possible for the second server instance node 524. Otherconfigurations are also possible.

The second server instance node 524 includes a first set of indicators526 and a second set of indicators 528. The indicators 526-528 identifynetwork indicators for the second server instance node 524. Theindicators 526-528 may identify network node operational measurements,network traffic indicator measurements, network traffic performancemeasurements, or other indicators.

Similar to the first server center node 506, the second service centernode 508 may have children network node type nodes, children networknode nodes, network traffic flow nodes, server instance nodes, indicatornodes, and other nodes. It is further possible that the children nodesof the second service node 508 are different than the first servicecenter node 506. Other configurations of the service model 502,including additional or different service center nodes, are alsopossible.

FIG. 6 is an example of the traffic shaping control layer 108 of thenetwork real-time monitoring and control system 102. The traffic shapingcontrol layer 108 is configured to receive a network traffic shapingcontrol from the event control layer 106. As previously discussed, thetraffic shaping control layer 108 may receive the network trafficshaping control when a user provides an acceptance acknowledgement of asuggest network traffic shaping control. Alternatively, the trafficshaping control layer 108 may receive the network traffic shapingcontrol automatically after a network traffic shaping control isgenerated.

In one implementation, the traffic shaping controller layer 108 includesa traffic controller 602 and a network node controller 604. The trafficcontroller 602 and the network node controller 604 are configured toexecute a network traffic shaping control to actively shape networktraffic flows for one or more network nodes 114-116. For example, thetraffic controller 602 and the network node controller 604 may beconfigured to execute a network traffic shaping control to activelyshape input network traffic flows 118. However, the traffic controller602 and the network node controller 604 may be configured to executenetwork traffic shaping controls to shape other network traffic flows,such as the output network traffic flow 120. The traffic controller 602and node controller 604 may also provide responses to originatingnetwork nodes from where the network traffic flows originated. Forexample, the traffic controller 602 and node controller 604 may provideintelligent responses to the originating network nodes when a networktraffic flow is shaped.

The traffic controller 602 and/or node controller 604 may be implementedin computer software or computer hardware. In one implementation, thetraffic controller 602 and node controller 604 are implemented on asingle network traffic shaping appliance that receives the networktraffic shaping control from the control management layer 306.Alternatively, the traffic controller 602 and the node controller 604may be implemented on two or more network traffic shaping appliances. Anexample of a network traffic shaping appliance that receives networktraffic controls is the BIG-IP Application Delivery Controller, which isavailable from F5 Networks, Inc. located in Seattle, Wash., UnitedStates. In this implementation, the control management layer 306communicates with the BIG-IP Application Delivery Controller usingsoftware designed to support interoperable machine-to-machineinteraction over a network, such as XML and Simple Object AccessProtocol (“SOAP”). The BIG-IP Application Delivery Controller may alsobe programmed using an internal scripting language, such as iRule, and aService Oriented Architecture (“SOA”) enabled Application ProgrammingInterface (“API”), such as iControl. Both iRule and iControl are alsoavailable from F5 Networks, Inc.

FIG. 7 shows an example of the reporting layer 110 and theadministrative layer 112 of the network real-time monitoring and controlsystem shown in FIG. 1. The reporting layer 110 handles the reportingfunctions of the network real-time monitoring and control system 102.The administrative layer 112 handles the administrative functions of thenetwork real-time monitoring and control system 102, such as displayinggraphical user interfaces, receiving configuration information,displaying results from shaping one or more network traffic flows, andother administrative functions.

The reporting layer 110 and administrative layer 112 may be implementedin computer hardware or computer software. In one implementation, thereporting layer 110 and 112 are implemented as servlet containers, usingsuch technologies as Apache Tomcat, which is available from the ApacheSoftware Foundation, located in Forest Hill, Md., United States. Thereporting layer 110 and administrative 112 may implement one or more webpages that are used to configure another technology used by the networkreal-time monitoring and control system 102, such as the OpenNMS systemthat may implement the monitoring layer 104 and the event control layer106.

The reporting layer 110 may include one or more components for providingreporting information to another component, layer, system, user, orother entity. In one implementation, the reporting layer 110 includes amonitoring component 706 and a reporting component 708. The monitoringcomponent 706 may monitor the data of the network real-time monitoringand control system 102, such as network traffic indicator measurements,network traffic performance measurements, network node operationalindicator measurements, network traffic shaping controls, or other data.The reporting component 708 may generate reports for the data monitoredby the monitoring component 706. The reporting layer 110 may communicatethe monitored and reported data to the administrative layer 112 foroutput to a user via a graphical user interface or output to anothersystem. Other types of output are also possible.

The administrative layer 112 may include one or more components formanaging the configuration of the network real-time monitoring andcontrol system 102. In one implementation, the administrative layer 112includes a control configuration component 710, a thresholdconfiguration component 712, a model configuration component 714, and anNPI configuration component 716. The control configuration component 710may receive inputs that configure one or more network traffic shapingcontrols or configures the parameter values for generating a networktraffic shaping control. For example, the control configurationcomponent 710 may be used by a user to control the lifecycle managementof a network traffic shaping control. A user may also use the controlconfiguration component 710 to accept or reject a suggested networktraffic shaping control suggested by the control manager 332.

The threshold configuration component 712 may receive inputs thatconfigure one or more thresholds, such as a warning threshold and acritical threshold, for one or more indicators monitored by the networkreal-time monitoring and control system 102. For example, the thresholdconfiguration 712 may receive inputs that configure network indicatorwarning thresholds, network performance warning thresholds, networkindicator critical thresholds, network performance warning thresholds,or any other threshold implemented by the network real-time monitoringand control system 102.

The model configuration component 714 may receive inputs that configurethe service model 502 stored in the service model database 318. The NPIconfiguration component 716 may receive inputs that configure thedetermination of network performance measurements, network indicatormeasurements, or any other measurement determined by the networkreal-time monitoring and control system 102.

Although the components 710-716 have been discussed with reference toreceiving input data, the components 710-716 may also be configured foroutputting data, such as the warning thresholds, the criticalthresholds, the service model, the network traffic shaping controls, orother data. As mentioned previously, outputting data may include thedisplay of data, the transmission of data, such as to another system,the storage of data, or any other type of output now known or laterdeveloped.

FIG. 8 shows an example of a network traffic shaping control state model802. The network traffic shaping control state model 802 defines thelife cycle of a network traffic shaping control. The network trafficshaping control sate model 802 may include one or more states, and thenetwork traffic shaping control may transition between these statesaccording to a network event identifier. The network traffic shapingcontrol may start at an initial state and transition between variousstates as network event identifiers are generated until the networktraffic shaping control reaches an ending state that ends the networktraffic shaping control.

The network traffic shaping control state model 802 provides a flexiblemodel for both automatically and manually managing network trafficshaping controls. As a network traffic shaping control may beautomatically suggested, manually suggested, automatically accepted, ormanually accepted, the network traffic shaping control model 802implements several states that account for the varying conditions underwhich a network traffic shaping control may be suggested or accepted.Moreover, the network traffic shaping control model 802 includes statesthat account for a potential failure in executing a control command thatis issued to control one or more network traffic shaping controls.

In one implementation, the network traffic shaping control state model802 includes five sets of states. The five sets of states include a setof pending states 804, a set of running states 806, a set of finishedstates 808, a set of stopped states 810, and a set of terminated states812. However, alternative state sets are also possible.

The network traffic shaping control state model 802 facilitatesdistinguishing the different causes for terminating or ending a networktraffic shaping control through the various state sets 808-812. Forexample, the network traffic shaping control state model 802 includesstate sets 808-812 that identify the different causes for the ending ofa network traffic shaping control. Exemplary causes for ending a networktraffic shaping control include manual termination by a user oroperator, which may be identified by the terminated state sets 812,automatic termination by the network real-time monitoring and controlsystem 102, which may be identified by the finished state set 808, orthe identification that one or more network nodes 114-116 have stoppedresponding, which may be identified by the stooped state set 810. Othercauses for ending a network traffic shaping control, such as acommunication failure in one or more layers of the real-time monitoringand control system 102 or a failure in the node controller 604 or thetraffic controller 602, are also possible.

In one implementation, the network traffic shaping control state model802 may be event driven so that implementing logic is based on eventsand a current state, such as using a finite state machine (“FSM”)paradigm. Moreover, the network traffic shaping control state mode 802is flexible and extensible to include other states and/or events, andmay be used in other contexts outside of VoIP. Alternatively, thenetwork traffic shaping control state model 802 may be implemented usinga business process management (“BPM”)

Each of the state sets 804-812 generally include states that identifythe general status of a network traffic shaping control. For example,the set of pending states 804 generally includes states in which anetwork traffic shaping control is pending execution by the trafficcontroller 602 or the node controller 604. Similarly, the set of runningstates 806 generally include states in which the network traffic shapingcontrol is being executed or transitioning to execution by the trafficController 602 or the node controller 604. In addition, the set offinished states 808 generally includes states in which the networktraffic shaping control has finished or transitioning to a finishingstate by the traffic controller 602 or the node controller 604 accordingto a finishing condition. Furthermore, the set of stopped states 810generally includes states in which the network traffic shaping controlhas stopped or is transitioning to a stopped state by the trafficcontroller 602 or the node controller 604. Finally, the set ofterminated states 812 generally includes states in which the networktraffic shaping has terminated or will be terminated by the trafficcontroller 602 or the node controller 604. However, each of the statesets 804-812 may also include alternative or different types of states.

In the example below, the network traffic shaping control has sixteenpossible states. However, other implementations may employ more or fewerstates. The different states may have a state type that defines whetherthe network traffic shaping control is in an initial state, anintermediary state, or an ending state. In general, an initial state isa state the network traffic shaping control is first assigned wheninstantiated. An intermediary state is a state reachable from theinitial state but it is not a final state of the network traffic shapingcontrol. An intermediary state may transition to another intermediarystate or an ending state. An ending state is reachable from the pendingstate and the intermediary state, but, in general, is a state that doesnot transition to another state.

Table 11 below provides an exemplary list of states. Table 11 lists thestate, the state set in which the state has been grouped, the statetype, and a brief description of the state. However, alternative statesthan those shown in Table 11 are also possible.

TABLE 11 State State Set State Type Description Aborted Pending StatesFinal State A state that indicates that the network traffic shapingcontrol has been aborted based on the satisfaction of an abortingcondition. Pending Pending States Initial State A state that indicatesthat the network traffic shaping control has been suggested and ispending execution. When instantiated, a network traffic shaping controlmay first be assigned a pending state. Deleted Pending States FinalState A state that indicates that the network traffic shaping controlhas been automatically deleted before being accepted. Discarded PendingStates Final State A state that indicates that the network trafficshaping control has been discarded since a newer network traffic shapingcontrol has been suggested. Wait Running Running States Intermediary Astate that indicates that a State run control command has been issued toexecute the network traffic shaping control, but the run control commandhas not yet been acknowledged. Running Running States Final State Astate that indicates that the network traffic shaping control is beingexecuted by a network traffic shaping-appliance. Failed Running StatesIntermediary A state that indicates that the Running State networktraffic control has failed due to the occurrence of a failing condition.Wait Finished Finished States Intermediary A state that indicates that aState finish control command has been issued to finish the networktraffic shaping control, but the finish control command has not yet beenacknowledged. Finished Finished States Final State A state thatindicates that the network traffic shaping control has finishedaccording the satisfaction of a finishing condition. Failed FinishedStates Intermediary A state that identifies that the Finished Statenetwork traffic shaping control has been unable to reach the finishedstate due to the occurrence of a failing condition. Wait Stopped StoppedStates Intermediary A state that indicates that a State stop controlcommand has been issued to stop the network traffic shaping control, butthe stop control command has not yet been acknowledged. Stopped StoppedStates Final State A state that identifies that the network trafficshaping control has stopped according to the satisfaction of a stoppingcondition. Failed Stopped States Intermediary A state that identifiesthat the Stopped State network traffic shaping control has been unableto reach the stopped state due to the satisfaction of a failingcondition. Wait Terminated Intermediary A state that indicates that aTerminated States State terminate control command has been issued toterminate the network traffic shaping control, but the terminate controlcommand has not yet been acknowledged. Terminated Terminated Final StateA state that identifies that the States network traffic shaping controlhas terminated according to the satisfaction of a terminating condition.Failed Terminated Intermediary A state that identifies that theTerminated States State network traffic shaping control has been unableto reach the terminated state due to the satisfaction of a failingcondition.

As shown in Table 11, one or more of the states may be reached accordingto the satisfaction of a condition. As previously discussed, conditionsmay include an aborting condition, terminating conditions, stoppedconditions, failing conditions, and finished conditions. The conditionsmay be defined by whether one or more particular network eventidentifiers have been generated. Accordingly, the conditions may besatisfied according to the generation of the network event identifier.However, the conditions may also be satisfied by another event, such asthe receipt of a request by the user to perform an action, or otherevent.

FIG. 9 shows one example of the pending state set 804 and the runningstate set 806. In one implementation, the pending state set 804 includesa pending state 902, an aborted state 904, a discarded state 908, and adeleted state 906. The pending state 902 is an initial state that occurswhen a network event identifier EVENT_SUGG_CONTR is generated. TheEVENT_SUGG_CONTR network event identifier identifies that a networktraffic shaping control has been generated and has been suggested. Thenetwork traffic shaping control may then transition to one or more ofthe states within the pending state set 804 according to thesatisfaction of a condition, such as an aborting condition, or theoccurrence of an event. Other conditions are also possible.

For transitioning between states 902-908 within the pending state set804, the pending state set 804 may include one or more intra-pendingstate transitions, such as an intra-pending state transition between thepending state 902 and the aborted state 904. In addition, the networktraffic shaping control may transition out of the pending state set 804from the pending state 902 according to a pending state transitionestablished between the pending state 902 and a wait running state 910.The network traffic shaping control may transition from the pendingstate 902 to the wait running state 910 when the network traffic shapingcontrol has been accepted, such as being accepted by a user, by anothersystem, or by automatic acceptance. Table 12 below lists statetransitions established between originating states and destinationstates including: the originating state, the state transition type, thecondition type that causes the state transition, the network eventidentifier that satisfies the condition that causes the network trafficshaping control to undergo the state transition, and the destinationstate.

TABLE 12 Originating Transition Condition Destination State Type TypeNetwork event identifier State Pending Intra- AbortingEVENT_USR_ANN_CONTR Aborted pending Pending Intra- DeletingEVENT_FINE_CONTR_RTC Deleted pending or EVENT_FINE_CONTR_OUT_SONDAPending Intra- Discarded EVENT_SUGG_CONTR Discarded pending PendingPending Accepting EVENT_USR_ACC_CONTR Wait Running

In one implementation, the running state set 806 includes a wait runningstate 910, a failed running state 912, and a running state 914. Thenetwork traffic shaping control enters the running state set 806 whenthe network traffic shaping control is assigned the wait running state910. After the network traffic shaping control is assigned the waitrunning state 910, the network traffic shaping control may thentransition to one or more of the states within the pending state set 804according to the satisfaction of a running condition, such as when thenetwork traffic shaping control has been accepted but not yet executedby the traffic controller 602 or the node controller 604. Other types ofrunning conditions are also possible.

For transitioning between states 910-914 within the running state set806, the running state set 806 may include one or more intra-runningstate transitions, such as an intra-running state transition between thewait running state 910 and the failed running state 912. In addition,the network traffic shaping control may transition out of the runningstate set 806 from the wait running state 910 or the running state 914according to a running state transition. A first running statetransition may be established between the wait running state 910 and thediscarded state 908, and a second running state transition may beestablished between the running state 914 and to a state selected fromthe group comprising a finished state, a terminated state, and a stoppedstate. The network traffic shaping control may transition from therunning state 914 to another state set when the network traffic shapingcontrol has been executed. Table 13 below lists state transitionsestablished in the running state set 806 and between originating statesand destination states. Table 13 also lists the state transition type,the condition type that causes the transition, and the network eventidentifier that satisfies the condition that causes the network trafficshaping control to undergo the transition.

TABLE 13 Originating Transition Condition Network event State Type Typeidentifier Destination State Wait Running Running DiscardingEVENT_USR_ACC_CONTR Discarded Wait Running Intra- FailingEVENT_USR_ACC_CONTR_KO Failed Running running or EVENT_NODE_UP_KO WaitRunning Intra- Running EVENT_USR_ACC_CONTR_OK Running running orEVENT_NODE_UP_OK Failed Intra- Running EVENT_NODE_UP Wait RunningRunning pending Failed Running Aborting EVENT_USR_ANN_CONTR AbortedRunning Failed Running Discarding EVENT_USR_ACC_CONTR Discarded RunningFailed Running Deleting EVENT_FINE_CONTR_RTC Deleted Running orEVENT_FINE_CONTR_RTC_OUT_SONDA

FIG. 10 shows one example of a finished state set 808 for the networktraffic shaping control state model 802. In one implementation, thefinished state set 808 includes a wait finished state 1002, a failedfinished state 1004, and a finished state 1006. The network trafficshaping control enters the finished state set 808 when the networktraffic shaping control is assigned the wait finished state 1002. Afterthe network traffic shaping control is assigned the wait finished state1002, the network traffic shaping control may then transition to one ormore of the states within the finished state set 808 according to thesatisfaction of a finishing condition, such as when the networkreal-time monitoring and control system 102 determines that the networktraffic shaping control is no longer needed. A finishing condition mayalso include that one or more network performance measurement valueshave fallen below a threshold, such as a network performance threshold.Other finishing conditions are also possible.

For transitioning between states 1002-1006 within the finished state set808, the finished state set 808 may establish one or more intra-finishedstate transitions, such as an intra-finished state transition betweenthe wait finished state 1002 and the failed finished state 1004. Table14 below lists state transitions established between originating statesand destination states of the finished state set 808 including: theoriginating state, the state transition type, the condition type thatcauses the transition, the network event identifier that satisfies thecondition that causes the network traffic shaping control to undergo thetransition, and the destination state. Table 14 also lists thetransition established between the running state 914 and the waitfinished state 1002.

TABLE 14 Originating Transition Condition Destination State Type TypeNetwork event identifier State Running Running WaitingEVENT_FINE_CONTR_RTC Wait Finished or EVENT_USR_ACC_CONTR Wait FinishedIntra- Failing EVENT_FINE_CONTR_RTC_KO Failed finished or FinishedEVENT_USR_ACC_CONTR_KO or EVENT_NODE_UP_KO Wait Finished Intra-Finishing EVENT_FINE_CONTR_RTC_OK Finished finished orEVENT_USR_ACC_CONTR_OK or EVENT_NODE_UP_OK Failed Intra- WaitingEVENT_NODE_UP Wait Finished Finished finished

FIG. 11 shows one example of a stopped state set 810 for the networktraffic shaping control state model 802. In one implementation, thestopped state set 810 includes a wait stopped state 1102, a failedstopped state 1104, and a stopped state 1106. The network trafficshaping control enters the stopped state set 810 when the networktraffic shaping control is assigned the wait stopped state 1102. Afterthe network traffic shaping control is assigned the wait stopped state1102, the network traffic shaping control may then transition to one ormore of the states within the stopped state set 810 according to thesatisfaction of a stopping condition, such as when the network real-timemonitoring and control system 102 determines that one or more of thenetwork nodes 114-116 has stopped responding, or the satisfaction of afailing condition. Other conditions are also possible.

For transitioning between states 1102-1106 within the stopped state set810, the stopped state set 810 may include one or more intra-stoppedstate transitions, such as an intra-stopped state transition between thewait stopped state 1102 and the failed stopped state 1104. Table 15below lists state transitions established between originating states anddestination states of the stopped state set 810 including: theoriginating state, the state transition type, the condition type thatcauses the transition, the network event identifier that satisfies thecondition that causes the network traffic shaping control to undergo thetransition, and the destination state. Table 15 also lists thetransition established between the running state 914 and the waitstopped state 1102.

TABLE 15 Originating Transition Condition Network event DestinationState Type Type identifier State Running Running WaitingEVENT_FINE_CONTR_RTC_OUT_SONDA Wait Stopped Wait Stopped Intra- FailingEVENT_FINE_CONTR_OUT_SONDA_KO Failed stopped or Stopped EVENT_NODE_UP_KOWait Stopped Intra- Stopping EVENT_FINE_CONTR_OUT_SONDA_OK Stoppedstopped or EVENT_NODE_UP_OK Failed Intra- Waiting EVENT_NODE_UP WaitStopped Stopped stopped

FIG. 12 shows one example of a terminated state set 812 for the networktraffic shaping control state model 802. In one implementation, theterminated state set 812 includes a wait terminated state 1202, a failedterminated state 1204, and a terminated state 1206. The network trafficshaping control enters the terminated state set 812 when the networktraffic shaping control is assigned the wait terminated state 1202.After the network traffic shaping control is assigned the waitterminated state 1202, the network traffic shaping control may thentransition to one or more of the states within the terminated state set812 according to the satisfaction of a terminating condition, such aswhen the network real-time monitoring and control system 102 or a userrequests the termination of the network traffic control, or thesatisfaction of a failing condition. Other conditions are also possible.

For transitioning between states 1202-1206 within the terminated stateset 812, the terminated state set 812 may include one or moreintra-terminated state transitions, such as an intra-terminated statetransition between the wait terminated state 1202 and the failedterminated state 1204. Table 16 below lists state transitionsestablished between originating states and destination states of theterminated state set 812 including: the originating state, the statetransition type, the condition type that causes the transition, thenetwork event identifier that satisfies the condition that causes thenetwork traffic shaping control to undergo the transition, and thedestination state. Table 16 also lists the transition establishedbetween the running state 914 and the wait terminated state 1202.

TABLE 16 Originating Transition Condition Destination State Type TypeNetwork event identifier State Running Running WaitingEVENT_USR_TERM_CONTR Wait Terminated Wait Intra- FailingEVENT_USR_TERM_CONTR_KO Failed Terminated terminated or TerminatedEVENT_NODE_UP_KO Wait Intra- Terminating EVENT_USR_TERM_CONTR_OKTerminated Terminated terminated or EVENT_NODE_UP_OK Failed Intra-Waiting EVENT_NODE_UP Wait Terminated terminated Terminated

The implementation of a network traffic shaping control may be based onthe issuance of one or more control commands. In general, a controlcommand is a command that controls a network traffic shaping control. Inthe implementation of the network traffic shaping control state modelshown in FIGS. 9-12, control commands include an abort control command,a discard control command, a delete control command, a run controlcommand, a finish control command, a stop control command, and aterminate control command. Each of the control commands may indicate adesired state in which to place a network traffic shaping control. Forexample, an abort control command may be a command that places thenetwork traffic shaping control in the aborted state 904. Similarly, therun control command may be a command that places the network trafficshaping control in the running state 914.

A control command may be issued by one or more layers, such as thecontrol management layer 306, with the intended recipient being anotherlayer or another component, such as the traffic controller 602 or thenode controller 604. However, there may be instances where a controlcommand is issued by a layer and the control command does not reach, oris unable to reach, its intended recipient. Exemplary instances where acontrol command does not reach its intended recipient include wherethere is a communication failure in one or more layers of the real-timemonitoring and control system 102, where the traffic controller 602 ornode controller 604 has stopped responding or has suffered a terminalfailure, or where one or more network nodes 114-116 have suffered anoutage.

Where an outage has occurred, the control command may be issued by thenetwork real-time monitoring and control system 102 to control a networktraffic shaping control, but the control command may not be successfullyexecuted or received by intended recipient of the control command. Forexample, a run control command may be issued to the traffic controller602, but the traffic controller 602 may have suffered an outage. In thisexample, the traffic controller 602 may be unable to run execute the runcontrol command and therefore transmit an acknowledgement that thetraffic controller 602 has executed the run control command. Outages mayalso occur within the network real-time monitoring and control system102, such as a communication failure between one or more layers 104-112.Where there is an outage between one or more layers 104-112, a controlcommand may be issued, but the control command may not reach itsintended destination, such as to another layer, to the trafficcontroller 602, to the node controller 604, or other component.

The potential for a loss in a control command is addressed by theimplementation of the various wait states 910, 1002, 1102, 1202 shown inFIGS. 9-12. The wait states 910, 1002, 1102, 1202 place a networktraffic shaping control in a waiting state until a decision is reachedas to whether a control command has been successfully received orexecuted. In one implementation, this decision is based on whether anacknowledgement of the control command is received during a timeoutperiod of a set period of time, such as a 1 second, 5 seconds, or anyother period of time. During the timeout period, the intended recipientof the control command may transmit an acknowledgement of the controlcommand, which in turn may trigger the generation of a network eventidentifier, such as the EVENT_FINE_CONTR_RTC_OK network eventidentifier, the EVENT_NODE_UP_OK network event identifier, or othernetwork event identifier, that places the network traffic shapingcontrol into an ending state, such as the discarded state 908, thefinished state 1006, or any other ending state.

However, during the same timeout period, the intended recipient of thecontrol command may not transmit an acknowledgement of the controlcommand. Where an acknowledgement of the control command is not receivedduring the timeout period, a network event identifier may be generatedthat places the network traffic shaping control into one of the failedstates, such as the failed running state 912, failed finished state1004, the failed stopped state 1104, or any other failed state. When thenetwork traffic shaping control is placed into a failed state, thereal-time monitoring and control system 102 may iteratively try tore-issue the control command that caused the network traffic shapingcontrol to be placed into the failed state. Alternatively, the real-timemonitoring and control system 102 may engage in a diagnostic analysis ofthe intended recipient of the control command that caused the networktraffic shaping control to be placed into the failed state. Thediagnostic analysis of the intended recipient may result in the restartof the intended recipient, such as where the traffic controller 602 ornode controller 604 has failed, or other corrective measures to beapplied, such as by transmitting an alarm or notice to the reportinglayer 110. Corrective measures may also include a diagnostic analysis ofone or more layers of the real-time monitoring and control system 102.

After the application of the corrective measures, the intended recipientof the control command may be identified as operating within apredetermined set of operational parameters. Where the intendedrecipient begins operating within operational parameters after thenetwork traffic shaping control is placed in a failed state, a networkevent identifier may be generated that places the network trafficshaping control back into a waiting state. For example, when the networktraffic shaping control is in the failed finished state 1004, theEVENT_NODE_UP network event identifier may be generated that places thenetwork traffic shaping control in the wait finished state 1002. Uponreturn to the waiting state, the control command that caused the initialfailure may be re-transmitted to the intended recipient and the timeoutperiod may begin tolling again until an acknowledgement is received fromthe intended recipient. When the acknowledgement is received from theintended recipient, a network event identifier may be generated thatplaces the network traffic shaping control into the ending state, suchas the finished state 1006.

Hence, the wait states 910, 1002, 1102, 1202 address a problem where anoutage may have occurred in the real-time monitoring and control system102 and the outage has not yet been acknowledged by the real-timemonitoring and control system 102. Rather than assuming that a controlcommand has been successfully executed, which would cause the networktraffic shaping control to enter an ending state, the wait states 910,1002, 1102, 1202 place the network traffic shaping control into awaiting state until the real-time monitoring and control system 102 canverify whether the control command was executed or receivedsuccessfully. Having the network traffic shaping control shaping controlenter an ending state, such as the deleted state 906, the finished state1006, or other ending state without verifying whether the controlcommand was successfully received or executed may result in undesirableeffects of the traffic flow to be shaped or being shaped by the networktraffic shaping control. Accordingly, the wait states 910, 1002, 1102,and 1202 present one technical measure that addresses the problem ofcontrolling a network traffic shaping control where an outage hasoccurred that has not yet been reported.

Exemplary aspects, features, and components of the system were describedabove. However, the system may be implemented in many different ways.For example, some features are shown stored in computer-readablememories and may be implemented with logic stored asprocessor-executable instructions or as data structures in acomputer-readable medium. Examples of computer-readable mediums includerandom access memory (RAM), read-only memory (ROM), erasable andrewriteable memory, removable discs, and fixed discs. Furthermore, allor part of the system and its logic and data structures may be storedon, distributed across, or read from other machine-readable media. Themedia may include hard disks, floppy disks, CD-ROMs, tangible signals,such as a signal received from a network, received over multiple packetscommunicated across the network, or received at an antenna or otherreceiver.

FIG. 13 shows one example of logic flow 1302 for generating a networktraffic shaping control. With reference to FIGS. 1-3 and FIGS. 6-7, thenetwork real-time monitoring and control system 102 may first monitorone or more traffic indicators (1304). The monitoring layer 104 mayobtain network traffic indicator measurements from the network trafficprobe 122, and store the network traffic indicator measurements in themonitored network traffic database 208 (1306). The event managementlayer 302 may retrieve one or more network traffic indicatormeasurements from the monitored network traffic database 208, andretrieve a network performance equation from the network performanceequation and threshold profile database 308 associated with theretrieved network traffic indicator measurements (1308). Using thenetwork traffic indicator measurements and the network performanceequation, the event management layer 302 determines one or more networkperformance measurements (1310). The event management layer 302 may alsodetermine network node operational performance measurements according toone or more network node operational indicator measurements.

After the network performance measurements have been obtained (1310),the event management layer 302 then retrieves one or more networktraffic thresholds from the network performance equation and thresholdprofile database 308. The network traffic thresholds may include networktraffic indicator thresholds, network traffic performance thresholds andnetwork node operational thresholds. The retrieved one or more networktraffic indicator thresholds may include warning thresholds, criticalthresholds, or any other threshold. The event management layer 302 maythen compare the network traffic indicator thresholds with thepreviously retrieved network traffic indicator measurements (1312).Alternatively, or in addition, the event management layer 302 maycompare the network performance measurements with the network trafficperformance thresholds (1314), or the event management layer 302 maycompare the network node operational indicator measurements with networknode operational indicator thresholds. Additional comparisons are alsopossible.

After the event management layer 302 has performed the comparisonoperations (1312/1314), the event management layer 302 may then generatea network event identifier according to the comparison (1316/1318). Thegenerated network event identifier may indicate that one or more of themeasurements have exceeded a threshold, such as a warning threshold orcritical threshold. Alternatively, the generated network eventidentifier may indicate that one or more of the measurements have notexceeded a threshold. A generated network event identifier may alsoindicate that one or more of the network nodes 114-116 arenon-responsive or that an unexpected error has occurred in thegeneration of the network event identifier. Other types of generatednetwork event identifiers are also possible.

The generated network event identifier is then communicated to thereal-time status analyzer 304. The real-time status analyzer 304correlates the communicated network event identifier with a network nodestatus identifier (1320). As previously discussed, the real-time statusanalyzer 304 may refer to a network node status rule set to correlatethe network event identifier with a network node status identifier.

Based on the network node status identifier obtained from correlatingthe network event identifier, the real-time status analyzer 304 maygenerate a request for a network traffic shaping control (1322). Thecontrol management layer 306 receives the request for the networktraffic shaping control, and determines the parameter values for thenetwork traffic shaping control (1324). Examples of parameters for anetwork traffic shaping control are shown in Tables 7-8 above. Thecontrol management layer 306 then communicates the network trafficshaping control to the traffic shaping control layer 108 for executionby the node controller 604, the traffic controller 602, or both (1326).

FIG. 14 shows one example of logic flow for generating a network trafficshaping control where the generated network traffic shaping control issubject to acceptance. Initially, the control management layer 306receives the request for the network traffic shaping control (1402) anddetermines the network traffic shaping control parameters for thenetwork traffic shaping control (1404). In an implementation where thegenerated network traffic shaping control is subject to user acceptance,the control management layer 306 outputs an acceptance request thatrequests acceptance of the generated network traffic shaping control(1406). The acceptance request may be output by the administrative layer112 of the network real-time monitoring and control system 102.Similarly, the administrative layer 112 may be tasked with receiving aresponse to the acceptance request (1408). Where the response is anacceptance acknowledgement of the network traffic shaping control thatindicates user acceptance of the suggested network traffic shapingcontrol, a network event identifier may be output that indicates thesuggested network traffic shaping control has been accepted (1410). Thenetwork event identifier may trigger an event where the network trafficshaping control is communicated to the traffic shaping control layer108.

In an alternative implementation, the acceptance of the network trafficshaping control automatic. In this alternative implementation, when thenetwork traffic shaping control is generated, the network trafficshaping control is automatically accepted and communicated to thetraffic shaping control layer 108. A network event identifier may begenerated that indicates that the network traffic shaping control hasbeen automatically accepted (1410).

The system may be implemented with additional, different, or fewercomponents. As one example, a processor may be implemented as amicroprocessor, a microcontroller, a DSP, an application specificintegrated circuit (ASIC), discrete logic, or a combination of othertypes of circuits or logic. As another example, memories may be DRAM,SRAM, Flash or any other type of memory. The processing capability ofthe system may be distributed among multiple components, such as amongmultiple processors and memories, optionally including multipledistributed processing systems. Parameters, databases, and other datastructures may be separately stored and managed, may be incorporatedinto a single memory or database, may be logically and physicallyorganized in many different ways, and may be implemented with differenttypes of data structures such as linked lists, hash tables, or implicitstorage mechanisms. Logic, such as programs or circuitry, may becombined or split among multiple programs, distributed across severalmemories and processors, and may be implemented in a library, such as ashared library (e.g., a dynamic link library (DLL)). The DLL, forexample, may store code that implements functionality for a specificmodule as noted above. As another example, the DLL may itself provideall or some of the functionality of the system.

In addition, the system may be implemented using one or more availabletechnologies. As mentioned throughout, the system may be implementedusing the OpenNMS network management platform, the XML specification, aJava Runtime Environment (“JRE”), the JBoss application server, theMicrosoft Excel spreadsheet application, the Apache Tomcat servletcontainer, and the PostgreSQL object-relational database managementsystem. The system may further be implemented with alternativetechnologies other than those described herein.

While various embodiments of the invention have been described, it willbe apparent to those of ordinary skill in the art that many moreembodiments and implementations are possible within the scope of theinvention. Accordingly, the invention is not to be restricted except inlight of the attached claims and their equivalents.

1-24. (canceled)
 25. A network real-time monitoring and control systemcomprising: a memory that stores executable instruction sets thatdefine: an event manager operative to: receive a monitored networktraffic indicator measurement associated with a network node froma-monitored traffic indicator measurement database; receive a monitorednetwork traffic indicator threshold associated with the monitorednetwork traffic indicator from a monitored network traffic indicatorthreshold database; generate a network performance measurement based onthe monitored network traffic indicator measurement and a networkperformance equation; request a network performance threshold from anetwork performance threshold profile; compare the generated networkperformance measurement with the network performance threshold; comparethe monitored network traffic indicator measurement with the retrievedmonitored network traffic indicator threshold; and generate a networkevent identifier based on the comparison of the traffic indicatormeasurement with the retrieved monitored network traffic indicatorthreshold, and the comparison of the generated network performancemeasurement with the network performance threshold.
 26. The networkreal-time monitoring and control system of claim 25 wherein themonitored network traffic indicator comprises a network traffic inputindicator that represents a particular network traffic type received bythe network node.
 27. The network real-time monitoring and controlsystem of claim 25 wherein the monitored network traffic indicatorcomprises a network traffic output indicator that represents aparticular network traffic type output by the network node.
 28. Thenetwork real-time monitoring and control system of claim 25, furthercomprising: a real-time status analyzer operative to: receive thenetwork event identifier from the event manager; correlate the networkevent identifier with a network node status identifier; generate arequest for a network traffic shaping control based on the correlationof the network event identifier with the network node status identifier.29. The network real-time monitoring and control system of claim 28,wherein: the memory further comprises a network node status rule setcomprising: the network node status identifier that identifies aninstability status of the network node; and a network node statuscondition associated with the network node status identifier thatidentifies the network node status identifier when the network nodestatus condition is satisfied.
 30. The network real-time monitoring andcontrol system of claim 29 wherein the real-time status analyzer isfurther operative to correlate the network node status identifier bydetermining whether the network event identifier satisfies the networknode status condition.
 31. The network real-time monitoring and controlsystem of claim 29 wherein the network node status condition issatisfied when the generated network event identifier identifies thatthe monitored network traffic indicator measurement has exceeded theretrieved monitored network traffic indicator threshold.
 32. The networkreal-time monitoring and control system of claim 29 wherein: the networknode status condition is a first network node status condition; and thenetwork node status rule set further comprises: a first network nodestatus condition priority associated with the first network node statuscondition that indicates a first priority level of the first networknode status condition; and a second network node status conditionpriority associated with a second network node status condition thatindicates a second priority level of the second network node statuscondition; and the first priority level is greater than the secondpriority level.
 33. The network real-time monitoring and control systemof claim 25, further comprising: a control manager operative to: receivethe request for the network traffic shaping control from the real-timestatus analyzer; receive a calculated network traffic shaping controlintensity for the network traffic shaping control, wherein the networktraffic shaping control intensity specifies a network traffic intensityfor a monitored network traffic flow of the network node; and output thenetwork traffic shaping control, wherein the network traffic shapingcontrol includes the calculated network traffic shaping controlintensity.
 34. The network real-time monitoring and control system ofclaim 33 wherein the control manager is further operative to: determinea suggested network traffic shaping control that includes the calculatednetwork traffic shaping control intensity; generate a control acceptancerequest that requests acceptance of the determined suggested networktraffic shaping control; and when the control manager receives anacceptance acknowledgment of the determined suggested network trafficshaping control, the control manager outputs the determined suggestednetwork traffic shaping control as the network traffic shaping control.35. The network real-time monitoring and control system of claim 33wherein the control manager is further operative to: receive atermination request to terminate the network traffic shaping control;and terminates the network traffic shaping control in response to thereceived termination request.
 36. A method of monitoring and controllingreal-time network traffic comprising: retrieving a network performanceequation that defines a network performance measurement; generating thenetwork performance measurement based on a monitored network trafficindicator measurement associated with a network node and the requestednetwork performance equation; comparing the generated networkperformance measurement with a network performance threshold; comparingthe monitored network traffic indicator measurement with a monitorednetwork traffic indicator threshold; generating a network eventidentifier based on the comparison of the traffic indicator measurementwith the monitored network traffic indicator threshold, and based on thecomparison of the generated network performance measurement with thenetwork performance threshold.
 37. The method of claim 36 wherein themonitored network traffic indicator comprises a network traffic inputindicator that represents a particular network traffic type received bythe network node.
 38. The method of claim 36 wherein the network trafficindicator comprises a network traffic output indicator that represents aparticular network traffic type output by the network node.
 39. Themethod of claim 36, further comprising: correlating the network eventidentifier with a network node status identifier; and generating arequest for a network traffic shaping control based on the correlationof the network event identifier with the network node status identifier.40. The method of claim 39 further comprising: defining a network nodestatus rule set comprising: the network node status identifier thatidentifies an instability status of the network node; and a network nodestatus condition associated with the network node status identifier thatidentifies the network node status identifier when the network nodestatus condition is satisfied.
 41. The method of claim 40 claim whereincorrelating the network event identifier with the network node statusidentifier comprises: determining whether the network event identifiersatisfies the network node status condition.
 42. The method of claim 40further comprising: satisfying the network node status condition whenthe generated network event identifier identifies that the monitorednetwork traffic indicator measurement has exceeded the retrievedmonitored network traffic indicator threshold.
 43. The method claim 40wherein: the network node status condition is a first network nodestatus condition; and the network node status rule set furthercomprises: a first network node status condition priority associatedwith the first network node status condition that indicates a firstpriority level of the first network node status condition; and a secondnetwork node status condition priority associated with a second networknode status condition that indicates a second priority level of thesecond network node status condition; and the first priority level isgreater than the second priority level.
 44. The method of claim 40,further comprising: calculating a network traffic shaping controlintensity for the network traffic shaping control, wherein the networktraffic shaping control intensity specifies a network traffic intensityfor the monitored network traffic flow of the network node; andoutputting the network traffic shaping control, wherein the networktraffic shaping control includes the calculated network traffic shapingcontrol intensity.
 45. The method of claim 19 wherein: the networktraffic flow is a first monitored network traffic flow; a first networktraffic flow priority is associated with the first monitored networktraffic flow that identifies a first priority level of the firstmonitored network traffic flow; and further comprising: monitoring asecond network traffic flow of the network node, wherein a secondnetwork traffic flow priority is associated with the second monitorednetwork traffic flow that identifies a second priority level of thesecond monitored network traffic flow; and calculating the networktraffic shaping control for the first monitored network traffic flowwhen the first network traffic flow priority is greater than the secondnetwork traffic flow priority.